Researchers Trace the DACgift Breach to 8,156 Exposed Customer Records

HEROIC analysts occured upon an exposure event tied to DACgift, an Indian online gift delivery platform. The breach surfaced on October 28, 2022, revealing 8,156 customer records pulled directly from a backend database. The compromised data included full names and email addresses, a combination that immediately flags the risk of personalized social engineering against real, identified individuals.

How Attackers Use Full Names and Emails to Target Real People

When first names, last names, and email addresses are exposed together, the data becomes significantly more accessable to bad actors for spear-phishing. Attackers no longer send generic spam. They send convincing messages addressed to the victim by name, referencing plausible contexts such as order confirmations, delivery updates, or account security alerts, dramatically increasing the likelihood of a successful deception.

What Was Exposed in the DACgift Breach

• Email Address
• First Name
• Last Name

Why Named Email Exposure Fuels Identity and Account Risks

Full name plus email combinations are partcularly useful for attackers attempting account takeovers on other services, since many platforms use email as the login identifier and first or last name for identity verification. This data can also be aggregated with other breach sets to build richer profiles on specific individuals, escalating the risk from simple spam to targeted identity theft and financial fraud.

How Database Breaches Work

A database breach occurs when an unauthorized party gains access to a structured data store, often through SQL injection, exposed credentials, or an insecured API endpoint. The attacker extracts records directly from user or customer tables, producing a clean dataset that can be packaged and distributed. Because e-commerce platforms routinely store customer contact information to support order management and communications, they are frequent targets for this type of attack.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your information against more than 400 billion records, including data from the DACgift breach and thousands of other known incidents. Search now to find out if your name or email address appeared in this or any other leak.