One California Wholesaler. 15,679 Records. The Frame & Optic Database Leak.

HEROIC analysts tracked a surgical database breach against Frame & Optic, a Southern California wholesale eyewear distributor, on January 1, 2025. The leak contained 15,679 customer records including email addresses, phone numbers, first names, and last names. The precision of the exfiltration suggests attackers knew exactly which tables they wanted before they arrived.

Why This Frame & Optic Database Breach Is Dangerous

Wholesale customer lists carry business context that consumer leaks do not. The contacts in this breach are optical-store owners, purchasing managers, and retail operators who regularly receive invoices, shipment notifications, and payment requests from vendors like Frame & Optic. That operational rhythm is a gift to business email compromise operators, who can insert themselves into existing invoicing conversations with near-perfect cover and redirect wire payments to attacker-controlled accounts.

What Was Exposed in Frame & Optic

• 15,679 records from Frame & Optic's wholesale customer database
• Email addresses tied to retail buyers and account managers
• Phone numbers used for order confirmation and B2B contact
• Full names matched to each business account

Why This Matters

Even without passwords, this breach is prime fuel for credential stuffing against business email accounts, account takeover on supplier portals, identity theft against small-business owners, and invoice fraud that targets the optical industry directly. The retail buyers in this dataset are a narrow, high-value audience, which is why attackers often hold these smaller lists in reserve for manually operated scams rather than mass phishing.

How Database Breaches Work

Database compromises against mid-size wholesale sites often begin with a stolen admin credential traded on a stealer log marketplace or a vulnerability in a customer-management plugin. Because attackers already know the database layout in many cases, they pull specific tables rather than dumping everything, which keeps the intrusion quieter and delays discovery. The extracted data then travels through private Telegram channels or is sold in targeted packages to fraud crews specializing in B2B scams.

Check If You Are Affected

HEROIC tracks more than 400 billion compromised records across surface web breaches, dark web marketplaces, and infostealer logs. Run a free scan to confirm whether your email or phone number was part of the Frame & Optic breach and to see all related leaks affecting your business identity.