The FutureShop Leak Exposed 13,897 UK Shopper Passwords

HEROIC analysts have added the FutureShop data breach to our records. FutureShop, a UK-based ecommerce platform at futureshop.co.uk, was breached on July 13, 2020, exposing 13,897 unique records. The compromised data includes email addresses and plaintext passwords, which were later posted on a popular hacking forum.

Why This Is Dangerous

Because these passwords were stored and leaked in plaintext, there is no encryption for an attacker to break through. Each of the 13,897 records pairs a UK shopper's email address directly with their exact password, giving anyone who obtains this file everything needed to attempt a login on FutureShop or anywhere else the same password was used.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

A leak like this one is a ready-made resource for credential stuffing, where attackers automatically test stolen email and password combinations against banking sites, email providers, and social media platforms. For the UK shoppers whose data was exposed here, password reuse is the main risk factor. If the same password unlocks another account, this leak can lead directly to account takeover, identity theft, or financial fraud well beyond the original FutureShop account.

How This Combolist Was Created

FutureShop's breach is classified as a database and combolist incident, meaning attackers accessed the platform's own customer database and later compiled the stolen data into a combolist, a simple file pairing each email address with its matching password. Combolists like this one are traded and reposted on hacking forums for years after the original breach, remaining effective against anyone who never updated the exposed password.

Check If You Are Affected

If you ever shopped at FutureShop, your email and password may still be circulating on hacking forums today. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including the FutureShop breach, so you can find out quickly whether your information was exposed.