The Bellas Artes Gandia Leak Could Unlock Your Email and Social Media

In June 2022, Bellas Artes Gandia, a Spanish e-commerce platform selling art supplies, suffered a database breach that exposed 3,491 customer records. The breach recieved no major press coverage, but the combination of password hashes, birthdays, and IP addresses in the dataset creates a chained risk that reaches far beyond this single platform. Anyone who reused their Bellas Artes Gandia password elsewhere may have multiple accounts at risk.

How the Bellas Artes Gandia Breach Can Unlock Other Accounts

The dataset contains both MD5 and bcrypt password hashes. MD5 hashes are easily cracked with modern tools, and once an attacker recovers a plain-text password, they can test it against the victim's email, social media, and banking logins. Birthday and gender data make identity verification bypasses easier, helping attackers answer security questions or impersonate the victim when contacting support teams.

What Was Exposed in the Bellas Artes Gandia Breach

• Email Address
• Password Hash (MD5 and bcrypt)
• First Name
• Last Name
• IP Address
• Gender
• Birthday

Why This Breach Creates a Chain of Risk

Birthdays and full names are commonly used to verify identity in account recovery flows. When combined with a cracked password from the Bellas Artes Gandia breach, an attacker has a strong starting point for account takeover attacks on Gmail, Facebook, banking portals, and other services. IP addresses also reveal the physical location of the victim, making it possible to craft highly localized and credible social engineering attempts.

How a Database Breach Works

A database breach occurs when attackers exploit a weakness in a web application to access and export records from the underlying data store. Methods include SQL injection, stolen database credentials, or exposed administrative panels. In the Bellas Artes Gandia incident, the attacker extracted structured customer records including both authentication data and personal profile fields, resulting in a rich dataset suitable for multiple types of downstream attacks.

Check If Your Data Was Exposed

HEROIC DarkWatch monitors over 400 billion exposed records from breaches worldwide, including incidents like the Bellas Artes Gandia leak. Search your email address now to find out if your data is part of this breach and get actionable steps to secure your accounts and prevent further exposure.