Cirulnik

We noticed a significant data leak originating from a Telegram channel on December 19, 2024, impacting a Russian beauty-retail entity known as Cirulnik. What struck us was the relatively low pwned count of 15,107 records, which, while not massive in absolute terms, represents a substantial portion of a niche business's customer base. The exposure of personally identifiable information (PII) alongside credential material, even in hashed form, warrants immediate attention due to its potential for downstream exploitation. The source of the leak appears to be a direct database dump, suggesting a critical vulnerability or a compromised internal system rather than a typical web application exploit.

The breach breakdown reveals that a dataset containing 15,107 records was disseminated on a public Telegram channel. This dataset comprises sensitive user information including email addresses, SHA-1 password hashes, first names, last names, and phone numbers. The inclusion of dates within the leaked data is also noted, though their specific context is not yet fully elucidated. Cirulnik, a beauty-retail company operating stores and salons across Russia and supplying professional beauty brands, is the identified victim. The nature of the leaked data suggests a compromise of a customer database, likely containing information collected during account creation or service bookings. The use of SHA-1 for password hashing, while not current best practice, still presents a risk, particularly if users have reused passwords across other platforms.

While specific news coverage directly linking this leak to Cirulnik in major outlets is limited at this time, the dissemination of such datasets on Telegram is a recurring theme in cybersecurity threat landscapes. Similar leaks of retail customer data have been reported globally, often originating from compromised databases or third-party service providers. Further OSINT investigation might reveal discussions on underground forums or other Telegram channels where this dataset was initially shared or traded, potentially offering clues about the attack vector or the threat actor's motivations. Research into common vulnerabilities affecting database systems used by retail businesses could also provide relevant external context.