Luxoia · Breach

[Single source] Claim: Actor sells data of 319,000 Luxoia jewelry customers

Nov 09, 2026 · 1 min read

An actor known as Sorb is selling data allegedly obtained from Luxoia, a Swiss online jewelry and watch retailer. The database reportedly holds names, addresses, dates of birth, phone numbers, 257,000 email addresses and purchase histories of about 319,000 customers, and a notification in the listing points to a third-party service provider. Customers should change reused passwords and watch for phishing.

By HIFY Radar newsroom Updated 11/09/2026 06:37 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

An actor using the name "Sorb" is advertising a database allegedly stolen from Luxoia, a Swiss online retailer specializing in jewelry, watches, and accessories. The trove is said to cover roughly 319,000 customers.

Alleged

The advertised data includes names, home addresses, dates of birth, phone numbers, some 257,000 email addresses, and purchase histories. The seller is asking $1,800 for exclusive access to the dataset. The claim is currently unverified.

What happened

Alleged

According to a post by DarkWebInformer, a threat actor known as "Sorb" has listed for sale customer data allegedly obtained from Luxoia, a Swiss online jewelry, watch, and accessories retailer. The listing claims the database affects 319,000 customers.

Alleged

The reported dataset contains names, residential addresses, dates of birth, phone numbers, 257,000 email addresses, and purchase histories. The actor's asking price is $1,800 for exclusive access to the data.

Alleged

A breach notification attached to the listing reportedly states that a third-party service provider experienced a security incident, and that payment information and passwords were not affected.

Why it matters

Inferred

The type of data on sale: full names paired with home addresses, dates of birth, phone numbers, and purchase histories: is a strong foundation for targeted phishing, identity fraud, and social-engineering attacks, even without passwords or payment cards.

Alleged

The listing includes a breach notification pointing to a security incident at a third-party service provider, which, if accurate, would add Luxoia to the growing list of retailers compromised through their supply chain rather than their own systems.

Inferred

At $1,800 for exclusive access, the dataset is priced for a single buyer, a pattern typical of sales aimed at fraudsters who want to monetize the information before it circulates more widely.

What to do

Inferred

Luxoia customers should treat any incoming communication referencing their orders or personal details with suspicion, since attackers holding purchase histories can craft highly convincing phishing messages.

Alleged

Because the included notice states that passwords and payment information were not affected, standard precautions: monitoring financial statements and changing reused passwords: remain sensible but no breach-specific password reset has been indicated in the current reporting.

Inferred

Organizations working with the implicated third-party service provider should verify whether their own data flows were exposed, pending confirmation of the incident.

Confirmed and still uncertain

Observed

Known: a seller named "Sorb" is advertising a Luxoia customer database covering a claimed 319,000 people, including names, addresses, dates of birth, phone numbers, 257,000 email addresses, and purchase histories, for $1,800 exclusive.

Alleged

Also known from the listing: a breach notification points to a security incident at a third-party service provider, and asserts that payment information and passwords were not affected.

Contested

Unknown: the claim is currently unverified. There is no independent confirmation of the breach, no identification of the third-party provider, no information on when the incident occurred, and no word yet from Luxoia itself.

What people are saying

Observed

DarkWebInformer, an account that monitors dark web marketplace activity, is the sole public source so far, stating the claim is currently unverified while reporting the seller's listing in full detail.

Observed

Neither Luxoia nor the referenced third-party service provider has any statement included in the current reporting.

Evolution

Observed

This X post appears to be the first public appearance of the Luxoia breach claim. No earlier public reporting on an incident at Luxoia or on the actor "Sorb" is present in the current evidence batch.

Inferred

Typical next developments to watch for: confirmation or denial from Luxoia, identification of the third-party provider, sample data being published by the seller, and eventual notifications to affected customers.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The advertised database fields are: names, residential addresses, dates of birth, phone numbers, email addresses (257,000), and purchase histories. The listing explicitly excludes payment information and passwords, according to the included breach notification.

Alleged

The breach notification attached to the sale attributes the incident to a security compromise at a third-party service provider rather than at Luxoia directly. The name of that provider is not disclosed in the current reporting.

Observed

The seller operates under the alias "Sorb" and is offering the dataset at $1,800 for exclusive access, meaning a single buyer would obtain the entire trove.

Sources and evidence

Observed

All current reporting derives from a single X post by DarkWebInformer, an account specializing in dark web monitoring, which itself flags the claim as unverified.

Contested

No Luxoia statement, regulatory filing, breach notification document, or independent forensic finding is available in the evidence batch. Readers should treat the breach claim, the data composition, and the third-party attribution as allegations until corroborated.