Roughly 57 million unique email addresses allegedly stolen from fashion retailer Hot Topic have been posted online, data breach notification website Have I Been Pwned warns.
The leaked information also includes names, addresses, phone numbers, dates of birth, partial credit card data, and other account details.
According to the data received and analyzed by Have I Been Pwned, the information of 56,904,909 Hot Topic accounts appears to have been compromised in the data breach, which occurred in October 2024.
The data breach was initially discovered after a threat actor boasted on an underground forum about hacking into BoxLunch, Hot Topic, and Torrid, claiming the theft of customer personally identifiable information (PII), payment information, and loyalty points.
The alleged hacker was offering the stolen information for $20,000, while asking Hot Topic to pay $100,000 in exchange for having the information removed.
According to Hudson Rock, the data breach might have been the result of a password-stealing malware infection on a Hot Topic employee’s computer. The hacker reportedly told the security firm that the information was exfiltrated from a Snowflake account that lacked multi-factor authentication (MFA).
Shortly after the initial report, Atlas Privacy analyzed the allegedly stolen data and identified approximately 54 million email addresses in it.
Roughly 25 million credit cards, 25 million names, 25 million phone numbers, and tens of millions of birth dates, home addresses, and job titles were also compromised, Atlas said.
SecurityWeek has emailed Hot Topic for a statement on the data breach and will update this article as soon as a reply arrives.
Related: Debt Relief Firm Forth Discloses Data Breach Impacting 1.5 Million People
Related: Law Firm Data Breach Impacts 300,000 Presbyterian Healthcare Patients
Related: Breach Exposed Dallas Student, Parent, Teacher Personal Data
Related: University Medical Center Says Hackers Breached Data Server
