Actor claims leak of data on 263K customers of defunct Aloyoga Soldes
A threat actor on an underground forum claims to have leaked the database of about 263,000 customers of Aloyoga Soldes, a defunct French discount store for yoga and activewear. According to the actor, the data includes emails, names, gender, dates of birth, MD5-hashed passwords, shipping city, postcode and country, and phone numbers, with an SQL file said to have been left exposed on the closed store's server. The claim is unverified; if authentic, reused passwords can be cracked and the data enables targeted phishing.
What happened
A threat actor on an underground forum claims to have leaked the database of roughly 263,000 customers of Aloyoga Soldes, a defunct French online discount store for yoga and activewear. The alleged data includes emails, names, gender, dates of birth, phone numbers, shipping addresses and MD5-hashed passwords. The claim has not been verified by the store or by third parties.
Why it matters
If confirmed, it exposes personal data of about 263,000 French consumers, with MD5-hashed passwords that are easy to crack. There is risk of account takeover where the password was reused and of targeted scams using names, birthdays and phone numbers. Because the store has shut down, there is no one to notify affected customers.
What to do
Track verification of the claim through intelligence channels before any communication. If there are customers or operations in France, advise changing passwords reused from the store. Check corporate email exposure in leaked credential monitoring.
For the technical team
- Affected
- Aloyoga Soldes Base de clientes da Aloyoga Soldes, loja online francesa de descontos de artigos de yoga e activewear, já encerrada; cer · Customers of Aloyoga Soldes, a defunct French online discount store for yoga and activewear; about 263,000 people in France. DailyDarkWeb assesses the site as an independent 'soldes' store, not the official Alo Yoga brand.
- Exploitation
- Leak claim posted on an underground forum; reported by DailyDarkWeb. No independent verification, no PoC or active exploitation described beyond the database posting.
- Fix
- No fix; the store is shut down, per the report. Analyst-suggested mitigation: change reused passwords, since unsalted MD5 hashes crack easily.
- Vector
- Alleged exposure of an SQL database file left on the server after the store shut down, according to the actor. Exploitation conditions unconfirmed; claim not verified.
- More details
- Alleged data: emails, first and last names, gender, date of birth, MD5-hashed password, shipping city, postcode and country, phone number. DailyDarkWeb analyst note: unsalted MD5 cracks easily, posing account takeover risk for password reuse and targeted phishing using names, birthdays and phone numbers. Threat-actor claim, not confirmation of a breach.
Timeline
First report: leak claim surfaces on an underground forum.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
