A hacker is selling account databases containing an aggregate total of 34 million user records that they claim were stolen from seventeen companies during data breaches, according to Bleepingcomputer.

On October 28th, a data breach broker created a new topic on a hacker forum to sell the stolen user databases for seventeen companies.

Stolen databases are typically sold first in private sales, like those listed above, with previous ranging from $500, as seen in the Zoosk data breach, to $100,000 for the Wattpad database.

After some time, it is common for the stolen databases to be released for free on hacker forums to increase a threat actor’s ‘street cred.’

According to the data breach broke, all of the seventeen databases being sold were obtained in 2020, with the largest breach being Geekie.com.br with 8.1 million records. The most well-known affected company is Singapore’s RedMart that exposed 1.1 million rec

The seller told BleepingComputer that they are selling the RedMart database for $1,500.

None of these companies have previously reported recent data breaches prior to this week.

After BleepingComputer contacted all affected companies, only RedMart disclosed a data breach yesterday, and Wongnai.com told BleepingComputer that they are investigating the incident.

“Thanks for your inquiry, we were aware of this incident last night (Bangkok time) and our tech team have been investigating this matter,” Wongnai emailed BleepingComputer.com.

Buy Me A Coffee

The seventeen databases being sold are shown below:

CompanyUser RecordsDisclosed?
Geekie.com.br8.1 millionNo
Clip.mx 4.7 millionNo
Wongnai.com4.3 millionYes via email
Cermati.com2.9 millionNo
Everything5pounds.com2.9 millionNo
Eatigo.com2.8 millionNo
Katapult.com2.2 millionNo
Wedmegood.com1.3 millionNo
RedMart1.1 millionYes
Coupontools.com1 millionNo
W3layouts.com789 thousandNo
Game24h.vn779 thousandNo
Invideo.io571 thousandNo
Apps-builder.com386 thousandNo
Fantasycruncher.com227 thousandNo
Athletico.com.br162 thousandNo
Toddycafe.com129 thousandNo

According to the seller, the following information is exposed per breach:

  • Redmart.lazada.sg: emails, SHA1 hashed passwords, mailing and billing addresses, full name, phone numbers, partial credit cards numbers and exp dates
  • Everything5pounds.com: emails, hashed passwords, name, gender, phone number
  • Geekie.com.br: emails, bcrypt-sha256/sha512 hashed passwords, usernames, names, DoB, gender, mobile phone number, Brazilian CPF numbers
  • Cermati.com: – emails, password bcrypt, name, address, phone, revenue, bank, tax number, id number, gender, job, company, mothers maiden name
  • Clip.mx: email, phone
  • Katapult.com: email, password pbkdf2-sha256/unknown, name
  • Eatigo.com: email, password md5, name, phone, gender, facebook id & token
  • Wongnai.com: email, password md5, ip, facebook & twitter id, names, birthdate, phone, zip
  • Toddycafe.com: email, password unknown, name, phone, address
  • Game24h.vn: email, password md5, username, birthdate, name
  • Wedmegood.com: email, password sha512, phone, facebook id
  • W3layouts.com: – email, password bcrypt, ip, country, city, state, phone, name
  • Apps-builder.com: email, password md5crypt, ip, name, country
  • Invideo.io: email, password bcrypt, name, phone
  • Coupontools.com: email, password bcrypt, name, phone, gender, birthdate
  • Athletico.com.br: email, password md5, name, cpf, birthdate
  • Fantasycruncher.com: email, password bcrypt/sha1, username, ip
New York Times Source Code Stolen Using Exposed GitHub Token

From the samples of each database seen by BleepingComputer, we have confirmed that exposed email addresses correspond to accounts for thirteen of the allegedly seventeen breached services. We could not verify accounts for Clip.mx, Katapult, CouponTools, or Aps-builder.com.