3195426 Customer Records Leaked From Blooms Today Breach

HEROIC analysts found a large dataset from Blooms Today listed for sale on a well-known hacking forum in April 2024. The data itself was dated to November 11, 2023, meaning it had been sitting in criminal hands for months before surfacing publicly. The breach covered approximately 3,195,426 unique customer records and included not just contact information but partial credit card details as well. This is a particularly damaging combination for an online retailer where customers routinely enter payment information at checkout.

Why Partial Credit Card Data Is Still Dangerous

Many people asume that because only the last four digits of a card are exposed, there is nothing to worry about. That is not quite right. Attackers pair the card type, last four digits, and expiration date with your name, email, and phone number to craft highly convincing fraud calls and messages. They can impersonate your bank, claim there is a problem with a recent order, and ask you to confirm your full card number to resolve it. With enough context, these scams are very hard to detect. The expiration date alone can also help attackers validate card data they have from other sources.

What Was Exposed in the Blooms Today Breach

• Email Address
• First Name
• Last Name
• Phone Number
• Partial Credit Card Data (card type, last four digits, expiration date)
• Physical Address

How a Flower Shop Breach Becomes an Identity Theft Problem

The combination of a full name, email, phone number, home address, and partial payment data is a goldmine for identity-focused criminals. This data is sold and resold across dark web markets, getting merged with information from other breaches into what are called combolists. From there, it fuels credential stuffing attacks, where automated tools try your email against hundreds of other services. It also enables account takeover fraud on banking and retail platforms, and in some cases feeds into larger identity theft schemes where criminals open credit lines in your name. This is not a seperate problem from a flower order: it follows your real-world identity.

How Database Breaches Happen at Retail Companies

Online retailers like Blooms Today store customer records in databases that are accessable to their internal order management systems. When these databases are poorly secured, attackers can exploit vulnerabilities in the website, use stolen employee credentials, or target third-party integrations to gain direct access. Once inside, exfiltrating millions of records takes very little time. The attacker then typically lists the data for sale on hacking forums, sometimes months after the initial intrusion, as occured here. Companies that do not actively monitor for unusual database queries or outbound data transfers often have no idea a breach happened until the data appears for sale.

Check If Your Blooms Today Data Was Exposed

If you ever ordered from Blooms Today, your email address, contact details, and payment card information may be in criminal hands right now. HEROIC's free breach scanner checks your email against more than 400 billion records across thousands of known breaches. It is free, takes seconds, and will tell you exactly where your data has appeared. Do not wait for a bank alert: scan your email at HEROIC today.