How a Dutch Flower Site, Bloemendelivery, Leaked 24,256 Customer Logins

HEROIC analysts confirmed the Bloemendelivery breach on July 9, 2025, after spotting a spike in credential stuffing attempts against the site. Bloemendelivery is a Netherlands based same day flower delivery e-commerce platform at bloemendelivery.nl. The compromise exposed 24,256 user records, including email addresses and pHpass password hashes.

Why the Bloemendelivery Breach Is Dangerous

Flower delivery sites do not feel like high value targets, which is exactly why they get ignored until the breach hits. Customers use real names, real addresses, and real payment methods, and they typically reuse the same email and password combination that unlocks their main inbox. Once the Bloemendelivery credentials are in an attacker's hands, every account tied to the same password is at risk.

What Was Exposed in the Bloemendelivery Leak

• Email addresses
• pHpass password hashes

Why This Matters

pHpass slows attackers down but does not stop them. With modern GPU hardware, weak passwords fall in minutes. Cracked passwords move straight into credential stuffing tools that spray login attempts across banking, email, and retail sites. For the 24,256 people in this file, an old flower order can turn into a drained bank account, a hijacked Gmail, or a fraudulent credit card application.

How the Bloemendelivery Database Dump Happened

A database dump is a raw export of a site's user authentication table. The Bloemendelivery exfiltration appears to have come from the platform's primary customer database. That means every registered user at the time of the theft is likely represented in the file. Attackers typically list these dumps on hacking forums and Telegram channels, where other criminals buy or copy them for credential stuffing, phishing, and fraud.

Check If You Are Affected

HEROIC tracks the Bloemendelivery breach alongside more than 400 billion other exposed records. A free breach scan will show you instantly if your email and password are circulating as part of this leak.