Gainful 2021 Data Breach Claim

The CSV member carries archive metadata dated 28 March 2021; this is used only as a year-level source-snapshot marker and is not interpreted as the date of access, exfiltration, or publication. No operator-published incident confirmation was located, so the record is published as an unverified third-party data-breach claim.

Both regular members of the 14,349,505-byte archive were fully accounted for and the archive passed its integrity test. Two independent compiled parsers inspected all 304,973 data rows in the 44,880,752-byte CSV. The exact header is email,order_number,date_paid,payment_method,filename. Only the first field, explicitly named email, is authorized for email import. Of that field, 304,936 canonical-valid occurrences were accepted, 37 values failed format rules, and deduplication left 102,413 unique canonical emails. The two parsers agreed on the occurrence stream and counts, and the canonical output was independently validated.

No email-shaped occurrence was found in any of the other four fields, and order numbers, payment dates, payment-method labels, and source-filename metadata will not be imported. Row-level payment dates range from 20 May 2019 through 19 October 2020; these are data-field values, not an incident date. The generic packaging note provides no incident date or field schema. Gainful’s official privacy policy confirms the processing of personal data in email, order, and payment contexts; this supports the corporate and schema context but does not confirm the incident or its date.

No matching Gainful entry was found in the current a public breach source catalogue, and that absence is not treated as disproof. The 304,973 raw CSV rows are not a people count and were not fitted to the 102,413 unique email relations. No operator-confirmed affected-person count was located, so no pwnCount is published. An email match alone would not prove that the person placed an order or that any other field co-occurred in the same record.