Scarlett Group Claims Spencer's Breach, Releases 1,558,731 Customer Accounts
Threat actor scarlettgroup claims to have breached Spencer's, the American novelty and specialty retail chain, and is releasing its customer database, with sample records already published. The advertised collection holds 1,558,731 user accounts and includes names, dates of birth, contact information, email addresses, phone numbers, and password hashes. The claim is unverified; customers should change reused passwords and watch for scams.
What happened
Threat actor scarlettgroup claims to have compromised Spencer's, the American novelty retail chain, and is releasing a customer database with 1,558,731 accounts. Sample records were published alongside the announcement. The claim is unverified.
Why it matters
If confirmed, it exposes names, dates of birth, and contact details of 1,558,731 customers, plus millions of loyalty program records, enabling scams, phishing, and password cracking from the hashes. It brings reputational risk and possible breach notification duties.
What to do
Watch for official confirmation from Spencer's; check whether corporate emails appear in the released data; tell customers and staff to change reused passwords and distrust contacts citing these details.
For the technical team
- Affected
- Spencer's, rede americana de lojas de novidades e presentes; base alegada de 1,55 milhão de contas de cliente e milhões · Spencer's, the American novelty and specialty retail chain; customer database and loyalty program.
- Exploitation
- Breach claim by threat actor scarlettgroup, reported by Dark Web Informer; sample customer records were published alongside the announcement. Claim is unverified.
- Fix
- Not applicable to a data leak.
- Vector
- Breach method not described in the sources; the group only claims to have compromised Spencer's network.
- More details
- Numbers advertised by the group: 1,558,731 user accounts, 1,550,695 loyalty members, 3,260,574 loyalty account records, and 12,897,184 loyalty extension records. Advertised data includes customer names, dates of birth, contact information, email addresses, phone numbers, and password hashes. Sources provide no timeline or access vector.
Timeline
Incident opened.
Sources 1 source
- @DarkWebInformer @DarkWebInformer
