Catwalk eCommerce Breach Exposes 235K User Accounts

HEROIC's DarkHive intelligence system discovered the Catwalk data breach, exposing 235,557 records. The breach occured in October 2011 and affected users of Catwalk, a Chinese eCommerce platform specializing in fashion and beauty products. Leaked data included email addresses, usernames, and MD5-hashed passwords.

Why This Is Dangerous

MD5 password hashes are widely considered cryptographically broken and can be cracked quickly using modern hardware and precomputed rainbow tables. Once cracked, attackers have working credentials to test against other shopping platforms, email services, and social media accounts. eCommerce users often link payment methods to thier accounts, meaning account takeover on related platforms can lead directly to financial theft.

What Was Exposed

• Email Address
• Username
• Password Hash (MD5)

Why This Matters

Fashion and beauty eCommerce users frequently share consistent personal details across platforms, making email addresses from this breach useful for targeted phishing and identity reconstruction attacks. Credential stuffing attacks using cracked Catwalk passwords can compromise accounts on other retail sites where victims may have stored payment information. The fraud risk from this breach extends beyond Catwalk itself to every other service where the same email and password combination was reused.

How Database Breaches Work

eCommerce platforms in 2011 often stored user databases with weak encryption standards that offered little real protection against a determined attacker. Once inside, attackers extract the complete customer database including all account credentials. The stolen records are packaged and distributed on dark web forums, where they get combined with other breach datasets into large collections used for credential stuffing campaigns against current e-commerce and financial platforms.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like Catwalk. Visit heroic.com to scan your email address and find out if your information was exposed.