Karelian Shoppers in Crosshairs: Berries of Karelia Leaks 3,690 Records

HEROIC analysts identified a data exposure tied to Berries of Karelia (Yagody Karelii), a Russian wild-berry and mushroom producer based in Kostomuksha, on December 28, 2024. The database leak contained 3,690 shopper records with phone numbers, first names, last names, and birthdays. Despite its modest size, the dataset narrowly targets a specific regional consumer base, making it useful to attackers who prioritize localized fraud.

Why This Berries of Karelia Database Breach Is Dangerous

Regional-business breaches like this one are often overlooked, but the combination of verified names, phone numbers, and birthdays is dangerously complete. Attackers can impersonate local delivery services, customer support, or loyalty programs with high confidence because they know genuine account details. In regions where residents are used to small-business communication, unsolicited messages referencing prior orders can bypass skepticism that would otherwise catch a generic phishing attempt.

What Was Exposed in Berries of Karelia

• 3,690 shopper records from Berries of Karelia
• Phone numbers used for order confirmation and delivery
• First names and last names tied to each customer account
• Birthdays used in loyalty promotions

Why This Matters

Even without passwords, the Berries of Karelia leak powers credential stuffing against Russian email and social platforms, account takeover on loyalty and delivery services, identity theft through the combination of name and birthday, and fraud schemes that cite real order context to appear credible. Attackers also frequently enrich smaller regional leaks with data from larger dumps to build complete profiles for targeted identity theft.

How Database Breaches Work

Small Russian e-commerce sites often run on outdated 1C-Bitrix installations or legacy CMS platforms with known vulnerabilities. Attackers scan broad IP ranges for these weaknesses, gain access through SQL injection or weak admin credentials, and exfiltrate user tables. The extracted data lands on Russian-language dark web marketplaces, where it is traded between identity fraud crews and aggregators who combine it with other breached corpora.

Check If You Are Affected

HEROIC maintains visibility into more than 400 billion compromised records across dark web marketplaces, underground forums, and surface web leaks. Run a free scan to confirm whether your phone number, name, or birthday appeared in the Berries of Karelia breach and to identify related leaks that may put your identity at risk.