Bestworkwear-UK Limited · Breach

[Single source] Claim: Actor sells data of 87,000 Bestworkwear customers

Nov 09, 2026 · 1 min read

An actor known as Sorb is selling a dataset with 87,000 email addresses and 86,000 phone numbers of customers of Bestworkwear-UK Limited, a British supplier of workwear and PPE. Sample records were published and the full dataset is up for sale. Customers should watch for targeted email and phone scams.

By HIFY Radar newsroom Updated 11/09/2026 06:59 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

An actor using the alias "Sorb" is advertising a dataset of approximately 87,000 customer records allegedly obtained from Bestworkwear-UK Limited, a British supplier of professional workwear, uniforms, and personal protective equipment (PPE). The listing, publicized by the monitoring account DarkWebInformer, includes sample records and offers the full dataset for $300. The claim is currently unverified.

What happened

Observed

On November 9, 2026, the X account DarkWebInformer published a post stating that an actor known as "Sorb" is selling customer information allegedly obtained from Bestworkwear-UK Limited.

Alleged

According to the post, the dataset reportedly contains 87,000 email addresses, 86,000 phone numbers, customer names, billing addresses, and business contact information. Sample records have been published, and the full dataset is being offered for sale at $300.

Why it matters

Inferred

If the dataset is genuine, the exposed combination of emails, phone numbers, names, and billing addresses would give attackers material for targeted phishing, smishing, and identity fraud against both individual customers and business clients of a PPE supplier.

Inferred

The low asking price of $300 suggests broad resale intent, making the data accessible to a wide range of low-tier fraud actors rather than a single sophisticated buyer.

What to do

Inferred

Customers of Bestworkwear should treat unsolicited calls, emails, or texts referencing orders, accounts, or billing details with heightened suspicion, since phone numbers and billing addresses are part of the advertised dataset.

Inferred

Security teams and journalists should treat the breach as alleged until Bestworkwear-UK Limited confirms a compromise or the published sample records are independently validated against known customers.

Confirmed and still uncertain

Observed

What is known: a sale listing by the actor "Sorb" exists, sample records have been published, and the asking price is $300. These facts come from a single monitoring account.

Inferred

What is unknown: whether the breach actually occurred, how the data was obtained, when the compromise took place, the accuracy of the record counts, and whether Bestworkwear-UK Limited is aware of or investigating the claim. DarkWebInformer itself states the claim is currently unverified.

What people are saying

Observed

The only voice in the current evidence pool is DarkWebInformer, which flagged the listing and explicitly cautioned that the claim is currently unverified. No statement from Bestworkwear-UK Limited, the actor "Sorb", or affected customers has been observed in this batch.

Evolution

Observed

This event is at its earliest observed stage: a single post dated November 9, 2026 announcing the sale. No prior related listings, follow-up posts, takedowns, or corporate responses appear in the evidence batch, so the trajectory of the claim remains to be seen.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The listing describes a structured customer dataset comprising 87,000 email addresses, 86,000 phone numbers, customer names, billing addresses, and business contact details. Sample records have been released as proof, and the complete dataset is priced at $300. No information is provided about the intrusion method, data format, or compromise date.

Sources and evidence

Inferred

This item rests on a single untrusted source: a post by the X account DarkWebInformer. There is no independent corroboration, no statement from Bestworkwear-UK Limited, and no verification of the published samples within the evidence batch. Confidence in the breach itself should therefore remain low until further evidence emerges.