Breach Year
2018
Breach Type
SaaS / Data Processor
TPRM Lesson
Form vendors quietly become long-term data warehouses.
What was the Typeform Form Builder Vendor Breach breach?
The Typeform breach was a June 2018 incident in which attackers accessed a partial backup file of the Spanish form-builder SaaS, exposing survey and form response data collected by hundreds of downstream customers including Airtasker, Monzo, Fortnum & Mason and Revolut.
Typeform showed how form vendors quietly become long-term data warehouses.
Customers used Typeform for a single survey or event registration, then never revisited the data. The vendor kept it.
When a partial backup was taken in June 2018, brands across banking, retail and hospitality had to notify respondents from campaigns that had ended years earlier.
Typeform is a SaaS platform for building online forms and surveys, popular with marketing, HR and events teams.
27 June 2018. An unknown third party accessed a partial backup of Typeform's server.
28 June 2018. Typeform disclosed the incident and started notifying customers.
July 2018. Downstream brands including Monzo, Revolut, Fortnum & Mason, Airtasker and the Tasmanian Electoral Commission disclosed their exposure.
The incident pushed shadow-IT reviews of marketing SaaS and standardised retention limits on form data across regulated industries.
The riskiest data was from campaigns nobody remembered. Old surveys were the biggest liability.
A. Identity and Access. SSO and MFA on all marketing SaaS.
B. SaaS and API Integrations. Discover form vendors via CASB.
C. Software Supply Chain. Track marketing-tech sub-processors.
D. File Transfer and Data Exchange. Prefer webhook exports over long-term SaaS storage.
E. Data Protection. Delete responses after export.
F. Vendor Incident Response. Contractual hours-based notification.
G. Fourth-Party Risk. Assess vendor backup providers.
H. Board and Executive Reporting. Report SaaS retention posture.
"Every form you forgot is a breach you haven't had yet."
A 2018 backup access incident that exposed form response data across hundreds of customers.
Downstream brands relied on Typeform to hold their form data.
Form and survey responses including personal details.
Monzo, Revolut, Fortnum & Mason, Airtasker and many others.
Typeform disclosed within 24 hours and rotated credentials.
Backup encryption, retention limits and shadow-IT controls.
SaaS form vendors are long-term data stores whether you plan for it or not.
No major regulatory fine was publicly disclosed.
All claims in this case study are grounded in verified public reporting.
TPRM Blog
Continue learning with the latest breach alerts, regulatory updates, and analyst playbooks from blog.learntprm.com.
Founding SponsorAlmost every case here was findable before it happened
Read enough third-party breaches and the pattern is brutal: an undisclosed fourth party, an expired certification, an exposure that sat on the internet for weeks. Nobody was lazy - the signals simply arrive faster than a human review cycle. The SAFE TPRM AI Co-Worker watches for them continuously.
This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.
Five correlated data dimensions per vendor, refreshed continuously across the whole portfolio.
For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.
25+
AI agents
90%
Less manual effort
None
Additional headcount
200+
Organizations globally
End to end
Intake to offboarding
Most people talk about risk management. Few can prove their expertise under pressure.
Start Your Free Certification