Bejwl

We noticed a recent leak originating from Bejwl, a Singapore-based e-commerce platform catering to the jewelry market. The discovery occurred on September 15, 2025, when a dataset containing approximately 987 unique records surfaced on a prominent hacking forum. What struck us immediately was the relatively small scale of the breach, yet the inclusion of personally identifiable information (PII) alongside credential material. This combination, even in a limited scope, presents a tangible risk for credential stuffing and targeted phishing campaigns against the affected user base.

The breach breakdown reveals a database compromise affecting Bejwl's customer base. The exposed records contain a mix of PII and authentication data, specifically Email Addresses, First Names, Last Names, Birthdays, and Gender. Crucially, the dataset also includes MD5 Hashed Passwords. While MD5 is a deprecated hashing algorithm and considered weak, its presence still allows for offline brute-force attacks and rainbow table lookups, particularly if users have reused passwords across different services. The source structure of the leak points to a direct database exfiltration, indicating a potential vulnerability in the platform's data access controls or an unauthorized database connection. The leak location on a public hacking forum amplifies the immediate threat of widespread dissemination and exploitation.

At present, there is no significant external news coverage or widespread OSINT chatter directly referencing the Bejwl breach. However, the nature of the leaked data, particularly the combination of PII and hashed credentials, aligns with common threat actor methodologies observed in broader campaigns targeting e-commerce platforms. Researchers have consistently highlighted the persistent risk posed by outdated hashing algorithms like MD5, even when coupled with other security measures, as they represent a low-hanging fruit for attackers seeking to compromise user accounts. The absence of immediate public attention does not diminish the inherent risks associated with this incident; rather, it suggests a more targeted or early-stage exploitation phase.