Employee PII in Spreadsheet Exports (Żabka Jira Breach Pattern)

On August 5, 2026, Polish convenience-store chain Żabka disclosed a breach of its technical infrastructure via an external service provider account; researcher Niebezpiecznik found 541,000 Jira work orders — packed with employee and contractor usernames and emails — offered for just €5,000 on a cybercrime forum. Days earlier, Switzerland's federal IT office (BIT) confirmed that credentials of roughly 200 accounts were compromised in its SharePoint breach, with CISA flagging CVE-2026-56164, CVE-2026-58644 and CVE-2026-50522 as actively exploited the same day. Both incidents show how bulk PII — names, national identifiers, phone numbers, corporate accounts — ends up packaged in spreadsheet exports and sold or reused for follow-on phishing. This demo ships an Excel export containing synthetic PII records (name, national ID, phone number — test values only, safe to run anywhere) in the exact shape of a stolen HR/IT export. MetaDefender Proactive DLP inspects file content — not just names or metadata — detects the PII patterns (national ID formats, phone numbers, personal-name columns), and blocks, quarantines or alerts before the file leaves the organization the way Żabka's Jira export did.