Actor claims to sell 400K Hachette Collections customer database
A threat actor on an underground forum claims to sell a database of about 400,000 customers of Hachette Collections, the French publisher of partwork series. The claimed dataset includes names, emails, dates of birth, addresses, phone numbers and order history. The claim is unverified and Hachette Collections has not confirmed an incident; monitor and prepare warnings against delivery and renewal scams.
What happened
A threat actor on an underground forum claims to sell a database of about 400,000 customers of Hachette Collections, the French publisher of partwork and collectible series. According to the actor, the dataset includes names, emails, dates of birth, addresses, phone numbers and order history. Hachette Collections has not confirmed an incident and the claim is unverified.
Why it matters
If confirmed, the leak exposes subscriber personal and purchase data, a base for fake delivery, renewal and payment emails. According to the DailyDarkWeb analyst note, customers with regular shipments are easy targets, because home addresses, dates of birth and order history make lures convincing. At this point there is no confirmed breach.
What to do
Wait for a statement from Hachette Collections and track verification of the claim. If the company is a customer or partner, review possibly exposed contacts and prepare a warning about delivery and renewal scams. Do not treat this as a confirmed breach.
For the technical team
- Affected
- Hachette Collections Base de clientes da Hachette Collections, editora francesa de coleções e partworks, segundo alegação em fórum subterrâne · Hachette Collections, customer database, per the claim. No specific version or system cited.
- Exploitation
- No exploitation reported. Sale claim reported by DailyDarkWeb, with no independent verification and no confirmation from Hachette Collections.
- Fix
- No fix applicable. No patch involved.
- Vector
- No technical detail. Underground forum claim of a database for sale; no intrusion vector described by the actor or the sources.
- More details
- Data claimed by the actor: emails, full names, titles and civil status; dates of birth, age group and gender; postal addresses, landline and mobile numbers; subscription status with start and end dates; order history, counts and values; loyalty points, customer segment and income bracket. The actor calls the data "fresh" and "not public anywhere" and takes offers privately. DailyDarkWeb analyst note: subscribers with regular shipments are easy targets for fake delivery, renewal and payment emails.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
