Inside the aloe-vera-beaute.com Customer File: 4,383 Logins Surface

HEROIC analysts tracked down a file uploaded to Telegram on December 1, 2020 built from a table labeled fact_customers, tied to aloe-vera-beaute.com. Inside were 4,383 records, each combining an email address, a plaintext password, and a URL pointing back to the login page it came from.

Why This Is Dangerous

A customer table typically holds the accounts of people who actually placed orders, which usually means real names tied to real emails rather than throwaway signups. Paired with a readable password, that makes each record here a working login an attacker can try today without any extra effort.

What Was Exposed

• Email addresses, the identifier attackers use to link this record to a person's other accounts
• Plaintext passwords, readable and usable the moment the file is opened
• URLs, marking exactly which login page each pair unlocks

Why This Matters

Customers who trust a site enough to place an order also tend to reuse that same login elsewhere, on email, on other shopping accounts, sometimes on banking portals. At 4,383 records, even a small reuse rate translates into a meaningful number of other accounts sitting open to anyone who tries the same password.

How This Breach Type Works

This record set is a combolist, meaning it was assembled from existing email and password pairs rather than pulled from a live intrusion happening in real time. Files like this get passed around on Telegram because they need no further work, and their main use is credential stuffing, where scripts test each pair automatically against a wide range of other login pages.

Was Your Email Part of This Customer File?

The only way to know for certain is to scan your email and review what comes back. If this password matches one you still use anywhere, replace it right away and turn on multi-factor authentication wherever it is available. Run the same check on your work email too, since the habit of reusing passwords rarely stays confined to one account.