The Casa Mascotas Breach Exposed 3,261 Customer Accounts in Portugal

HEROIC analysts recieved data in July 2022 showing that Casa Mascotas, a Portugal-based e-commerce platform, had suffered a database breach that exposed 3,261 customer records. The leaked dataset included email addresses, first and last names, IP addresses, gender, and password hashes stored in both MD5 and bcrypt formats. The breach was identified through dark web monitoring and flagged for elevated risk due to the mix of weak and strong hashing algorithms present in the exposed data.

How Exposed Names, Emails, and Weak Password Hashes Enable Identity Fraud

When a breach includes full names, email addresses, and MD5-hashed passwords together, attackers have everything they need to launch highly targeted phishing campaigns and crack credentials. MD5 hashes are accessable to cracking through widely available tools and precomputed rainbow tables, meaning many passwords in this dataset can be recovered in minutes. Attackers who recover a password can then test it against banking, email, and social media accounts using automated credential stuffing tools.

What Was Exposed in the Casa Mascotas Breach

• Email Address
• Password Hash (MD5 and bcrypt)
• First Name
• Last Name
• IP Address
• Gender

Why a Pet Supply Breach Still Carries Serious Risk

Even breaches from niche e-commerce platforms carry real downstream risk. Users who registered at Casa Mascotas likely used the same email and password combination on other sites. Credential stuffing attacks are partcularly effective when attackers have full names and IP address history, which helps them bypass security questions and pass basic fraud detection checks. An occured breach at a small retailer can directly enable account takeover at larger financial institutions.

How a Database Breach Works

A database breach occurs when an unauthorized party gains access to a backend data store, typically through SQL injection, unpatched software vulnerabilities, or exposed database credentials. The attacker extracts user tables and exports them as structured files. Those files are then sold or posted on dark web forums, where other threat actors use the email and password combinations in automated attacks against other platforms and services.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion compromised records, including the Casa Mascotas dataset. If your email or personal information appeared in this breach or any other known leak, HEROIC can notify you immediately. Visit HEROIC.com to run a free scan and find out if your credentials are at risk.