Threat actor claims sale of 1,048,576 MyHairCare customer records
A threat actor is offering on an underground forum a claimed database of about 1,048,576 customer records from MyHairCare, an Australian online hair-care retailer. The batch would include last names, emails, phone numbers, location and amounts spent; MyHairCare has not confirmed an incident. The exact count matches a spreadsheet's maximum row limit, so the export may be truncated or padded; such contact and spend data fuels targeted phishing and fake refund scams.
What happened
A threat actor claims to sell about 1,048,576 customer records from MyHairCare, an Australian online hair-care retailer. The batch would include last names, emails, phone numbers, location and amounts spent per customer. The company has not confirmed an incident and the claim remains unverified.
Why it matters
If confirmed, criminals would hold customer names, contacts and spend history, ideal material for targeted phishing and fake refund scams. For the brand, there is risk of fraud against customers and loss of trust.
What to do
Treat it as an unconfirmed claim and monitor MyHairCare's official channels. The security team should track the forum and seek a sample of the database to validate before any communication. Warn customers about refund or order emails and calls.
For the technical team
- Affected
- MyHairCare, varejista online australiana de produtos capilares; base alegada de cerca de 1.048.576 registros de clientes · MyHairCare customer base; MyHairCare is an Australian online hair-care retailer. Claimed fields: last name, email, phone, city, postcode, province, country, total amount spent, currency and email-verification status.
- Exploitation
- No exploitation reported. Sale announced on an underground forum and reported by DailyDarkWeb; MyHairCare has not confirmed an incident.
- Fix
- Not applicable; alleged leak, no software fix.
- More details
- The exact count of 1,048,576 matches a spreadsheet's maximum row limit, so the export may be truncated or padded, per DailyDarkWeb. Even if truncated, the data would serve for targeted phishing and fake refund scams.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
