How We Found the DANSWinkel Leak Listed Across Underground Forums

HEROIC analysts tracked an unusual spike in dark web chatter around a Dutch e-commerce platform, DANSWinkel, on December 29, 2024. Following the trail led to a structured database dump containing 91,596 customer records with email addresses, phone numbers, first names, last names, IP addresses, and salted MD5 password hashes. The organized format strongly pointed to a direct database exfiltration rather than a casual scrape.

Why This DANSWinkel Database Breach Is Dangerous

Salted MD5 hashes improve on raw MD5 but remain well within reach of modern GPU cracking rigs. Combined with IP addresses, the DANSWinkel leak gives attackers a complete authentication fingerprint: a login credential, a known connection point, and the personal context to bypass risk-based authentication on many platforms. That is enough to defeat many basic anti-fraud controls on consumer services that rely on device and location signals.

What Was Exposed in DANSWinkel

• 91,596 customer records from DANSWinkel
• Email addresses tied to dance-footwear shoppers
• Phone numbers used for order confirmation
• First names, last names, and IP addresses
• Password hashes stored with salted MD5

Why This Matters

Once the hashes are cracked, the DANSWinkel leak fuels credential stuffing against email and banking, account takeover on e-commerce sites where customers reused the password, identity theft through the combination of name and IP, and fraud tied to order diversion or loyalty-point theft. Dutch shoppers are also at heightened risk of tax-season phishing that cites real account details to appear credible.

How Database Breaches Work

E-commerce database breaches often start with SQL injection on a vulnerable product-search endpoint, a compromised admin credential, or an exploited CMS plugin. Once attackers gain read access, they exfiltrate entire user tables in a single operation. The data is then listed on underground marketplaces, where purchasers run offline cracking rigs to turn hashed passwords into working credentials before rolling them into credential stuffing campaigns.

Check If You Are Affected

HEROIC maintains visibility into more than 400 billion compromised records across surface web breaches, dark web marketplaces, and stealer logs. Run a free scan to check whether your email, phone number, or password hash appeared in the DANSWinkel breach and to see every other leak affecting your identity.