How the FlexyStore hack exposed passwords for 10,030 people

FlexyStore, a UK-based eCommerce platform bridging physical and digital retail, had its database compromised on January 9, 2023, with 10,030 records exposed. The breach recieved attention in security circles due to the combination of personal identifiers and bcrypt-hashed passwords found in the leaked dataset. Exposed data included email addresses, usernames, first names, last names, and password hashes belonging to FlexyStore customers.

Why Exposed Password Hashes Put You at Risk

Although bcrypt is a strong hashing algorithm, large-scale datasets still make offline cracking attempts feasable for well-resourced attackers using GPU-based tools. If a password is weak or commonly used, it can still be recovered even from a bcrypt hash given enough time and computing power. Additionally, the accompanying personal details in this breach make it easier for attackers to craft convincing phishing messages targeting affected users.

What Was Exposed in the FlexyStore Breach

• Email Address
• Password Hash
• Username
• First Name
• Last Name

Why the FlexyStore Breach Still Matters Today

Leaked credentials from eCommerce platforms are partcularly valuable to criminals because they are often tied to accounts with saved payment methods and shipping addresses. Even if your FlexyStore password has since been changed, your email address and personal details from this breach remain in circulation and can be used for targeted phishing attempts. The ongoing trade of this data on dark web forums means the risk does not diminish over time.

How Database Breaches Work

A database breach occurs when unauthorized actors gain access to a company's backend data storage, typically by exploiting software vulnerabilities, weak access controls, or stolen administrative credentials. Once inside, attackers copy and export user tables containing personal and authentication data. The extracted records are then packaged and distributed through underground channels.

Check If Your Data Was Exposed

HEROIC's breach intelligence platform covers over 400 billion compromised records from data incidents across the globe. Search your email address now to find out if you were affected by the FlexyStore breach or any other known data leak, and get clear guidance on protecting your accounts going forward.