The Dormity Dump: 1,639 Customer Credentials Leaked From a Spanish eCommerce Store

HEROIC analysts identified a data exposure originating from Dormity, a Spanish e-commerce platform specializing in mattresses and sleep products, with the leak surfacing on July 22, 2022. The breach occured through a direct database compromise affecting 1,639 records. The exposed dataset contained customer usernames, email addresses, full names, and hashed passwords, providing attackers with a complete credential profile for each affected user.

Customer Credentials Exposed: What Attackers Can Do With Dormity's Leaked Data

With email addresses, usernames, and hashed passwords in hand, attackers can run offline password cracking attempts and then test recovered credentials against other services. The combination of username plus email in the same record is partcularly valuable for credential stuffing tools, which can automatically test these pairs across hundreds of platforms. Victims who reused their Dormity password elsewhere face a real risk of account takeover across email, banking, and social media services, along with potential identity theft if personal data is used in targeted phishing.

What Was Exposed in the Dormity Breach

• Email Address
• Password Hash
• Username
• First Name
• Last Name

Why eCommerce Breaches Enable Identity Theft and Financial Fraud

Online retail platforms collect a dependable set of data that attackers find highly useful: real names, email addresses tied to active accounts, and passwords that users recieved across multiple services. Even a breach of under 2,000 records can fuel a wave of targeted attacks if the affected users hold accounts at high-value services like PayPal or online banking. Credential stuffing using eCommerce credentials is among the most common and accessable attack techniques available to cybercriminals, requiring minimal investment and yielding access to financial accounts and personal data. The downstream risk from this breach includes account takeover, identity theft, and financial fraud for every individual named in the dataset.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a backend data store, typically through a web application vulnerability, misconfigured server, or compromised credentials. In Dormity's case, the attacker extracted customer records directly from the database. The exported data is then compressed and posted on dark web forums or sold to other criminals who specialize in exploiting hashed passwords and using recovered credentials in automated login attacks. Even hashed and salted passwords are not fully safe if weak or common passwords were originally chosen by users.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records, including data from the Dormity breach and thousands of other incidents worldwide. Visit HEROIC.com to run a free check on your email address and find out whether your credentials are circulating online before an attacker uses them against you.