Actor claims to sell 2026 Wildberries customer database
A threat actor on an underground forum claims to sell a 2026 customer database attributed to Wildberries, Russia's largest online retailer; the sample would include emails, full names, phone numbers and user IDs. The listing sits in the unverified sellers section, with no record count or price, and Wildberries has not confirmed an incident. DailyDarkWeb notes that sample rows look like test accounts, but name and phone data is enough for phishing and fake delivery scams.
What happened
A threat actor on an underground forum claims to sell a 2026 customer database of Wildberries, Russia's largest online retailer. The posted sample would include emails, full names, phone numbers and user IDs. Wildberries has not confirmed an incident and the listing sits in the forum's unverified sellers section.
Why it matters
If confirmed, data such as name, phone and email opens the door to phishing and fake delivery scams against customers of Russia's largest e-commerce platform. The offer gives no record count or price, which lowers its credibility. Claims like this also damage brand trust even without confirmation.
What to do
Monitor fraud channels and social media for campaigns using customer names and phone numbers. Strengthen antiphishing warnings and delivery message verification. Treat it as a breach only after official confirmation.
For the technical team
- Affected
- Wildberries, maior varejista online da Rússia; base de clientes alegadamente à venda em fórum subterrâneo · Customer database allegedly from 2026, attributed to Wildberries, Russia's largest online retailer.
- Exploitation
- No exploitation reported. Alleged sale on an underground forum, unverified sellers section, reported by DailyDarkWeb. Claim not independently verified; Wildberries has not confirmed an incident.
- Fix
- No software to update
- More details
- The listing gives no record count or price. Sample rows redact personal details; the DailyDarkWeb analyst notes several rows look like test or placeholder accounts with very low user IDs, suggesting an old, partial or recycled set rather than a fresh breach. Name plus phone data is still enough for marketplace themed phishing and fake delivery scams.
Timeline
Claim of Wildberries customer database sale surfaces on underground forum.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
