Search Your Email: The Dropmatix Breach Exposed 35,151 Accounts

HEROIC identified 35,151 records from Dropmatix surfacing on April 25, 2025, exposing email addresses, first names, last names, and business order details from the German e-commerce ERP platform. The leak ties together identity data with operational business information, giving attackers an unusually rich dataset to exploit.

Why This Dropmatix Database Leak Is Dangerous

Dropmatix is used by online retailers to coordinate sales, inventory, and order fulfillment. A breach here does not stop at individual accounts. It hands attackers visibility into purchasing behavior, supplier relationships, and customer contact details across thousands of small and mid-sized merchants. The combination of verified business email addresses, full names, and real order history is exactly what sophisticated phishing operations look for.

What Was Exposed in the Dropmatix Breach

• Email addresses tied to active ERP accounts
• First and last names of account holders
• Company names and business affiliations
• Physical and geographic address data
• Order details from connected store operations

No passwords were confirmed in the dataset, but the personal and commercial information alone is enough to fuel targeted attacks.

Why This Matters

Even without passwords, leaked email and name pairs feed directly into credential stuffing campaigns, where attackers pair them with passwords harvested from other breaches to take over accounts. For Dropmatix users, the added business context raises the stakes. Invoice fraud, fake supplier emails, and account takeover attempts against connected storefronts all become easier when attackers already know who you are, what you sell, and who your customers are. Identity theft and follow-on fraud remain a long-term risk once this data is circulating.

How Database Breaches Like This Work

Database compromises typically start with an exposed endpoint, a weak admin credential, or an injection flaw in a web application. Once inside, an attacker can dump entire customer tables, often without triggering obvious alarms. The stolen database is then sold or traded on dark web forums, where it gets recombined with other leaks to build richer profiles on individuals and companies. This is how a single ERP incident can feed years of downstream attacks.

Check If You Are Affected

If you used Dropmatix or operate a store connected to the platform, assume your contact and order data is now circulating. HEROIC maintains a breach intelligence database of more than 400 billion compromised records, and you can scan your email to see whether it appears in this leak or any other exposure we have indexed.