Alleged sale of 3M+ Beauty Success loyalty records on dark web
A threat actor is selling a database on an underground forum that they claim comes from the loyalty program of Beauty Success, the French perfume retail chain of Groupe Novi, with more than 3 million alleged records. The seller says the data of names, emails, birthdates and account creation dates was scraped from the loyalty platform and shared a sample; the claim is unconfirmed by the company. Customers should watch for brand phishing and change reused passwords.
What happened
A threat actor announced on an underground forum the sale of a database they attribute to the Beauty Success loyalty program, the French perfume retail chain of Groupe Novi. The seller claims more than 3 million records, with names, emails and dates of birth, and shared a sample. According to DailyDarkWeb, the company has not confirmed an incident.
Why it matters
If genuine, the database is direct material for large scale phishing and brand impersonation, DailyDarkWeb assesses. Customer personal data in France could raise GDPR questions. Users of the loyalty program are the exposed audience.
What to do
Treat it as an unconfirmed claim until an official statement from Beauty Success. Customers should distrust messages in the brand's name and change reused passwords. Security teams should watch for the sample being used in phishing campaigns.
For the technical team
- Affected
- Groupe Novi Beauty Success, rede francesa de perfumarias e cosméticos do Groupe Novi; programa de fidelidade com base alegada de mai · Beauty Success loyalty program, French perfume retail chain of Groupe Novi, per the seller's claim. Versions not applicable.
- Exploitation
- Sale listing on an underground forum with a sample file, disclosed by DailyDarkWeb. Unverified claim; Beauty Success has not confirmed an incident, according to DailyDarkWeb.
- Fix
- Not applicable to a data leak; no fix or mitigation cited in the sources.
- Vector
- Scraping of the loyalty platform, according to the seller's claim. No specific vulnerability or exploitation condition cited in the sources.
- More details
- Fields claimed in the listing: first and last names, email addresses, dates of birth and account creation dates. DailyDarkWeb assesses that, if genuine, a base of names, emails and birthdates at this scale is a strong base for phishing and brand impersonation, and could raise GDPR questions.
Timeline
DailyDarkWeb post surfaced the underground forum listing with a data sample.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
