If You Shopped at CalcioShop, the 2019 Data Breach Should Concern You

HEROIC analysts uncovered that CalcioShop, an Italian sportswear retailer, experienced a database breach in October 2019 that exposed 196,551 customer records. The breach occured after a server was left publicly accessable, allowing unauthorized parties to extract customer data including email addresses, phone numbers, full names, and IP addresses. This incident has continued to surface in breach trading communities, keeping the risk alive for affected shoppers years later.

How Exposed Email Addresses, Phone Numbers, and IP Addresses Enable Targeted Fraud

With full names, email addresses, phone numbers, and IP addresses combined, attackers can construct highly convincing phishing messages and voice scams tailored to each individual. The IP address data also reveals approximate geographic location, making it easier to craft region-specific lures. Even without passwords, this combination of data is partcularly useful for building detailed profiles used in follow-on fraud campaigns.

What Was Exposed in the CalcioShop 2019 Breach

• Email Address
• Phone Number
• First Name
• Last Name
• IP Address

Why Customer Data from an eCommerce Retailer Remains a Long-Term Threat

Shoppers who made purchases at CalcioShop beleive their data was only shared with the retailer, but once that data enters underground markets it can be matched against other breach datasets to build richer profiles. Email and phone combinations are recieved eagerly by SMS phishing operators and call-center fraud groups who use them to impersonate legitimate companies and extract payment details or account credentials from unsuspecting victims.

How Database Breaches Work

A database breach happens when an unauthorized party gains access to a stored collection of records, often through a misconfigured or publicly exposed server. In the case of CalcioShop, the server was left without proper access controls, allowing anyone who located it to download the customer database. Stolen records are then distributed across hacking forums and Telegram channels where they are traded for use in phishing, fraud, and identity theft operations.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against more than 400 billion records, including the CalcioShop 2019 breach. Run a free scan today to see what personal information is circulating about you and get guidance on protecting your accounts and identity.