How the HomeRefill Database Breach Exposed 190K Brazilian Shoppers

HEROIC analysts flagged the HomeRefill breach after detecting it indexed on multiple breach aggregation platforms. In April 2020, this Brazilian eCommerce platform recieved a critical security failure when an exposed database allowed attackers to extract 190,544 customer records. The compromised data included email addresses, phone numbers, password hashes, full names, birthdays, and cryptographic salts, creating a comprehensive profile on each affected user.

Why Birthdays, Phone Numbers, and Password Hashes Together Are Especially Dangerous

When attackers obtain a combination of birthdays, phone numbers, and hashed passwords from the HomeRefill breach, the risk of identity fraud becomes partcularly acute. Birthdays are frequently used as security verification answers. Phone numbers enable SIM-swapping attacks. Password hashes, even salted ones, can be attacked with enough resources. Together, these data points give criminals the tools to impersonate victims across financial institutions, telecom providers, and online services.

What Was Exposed in the HomeRefill Breach

• Email Address
• Phone Number
• Password Hash
• First Name
• Last Name
• Birthday
• Salt

Why the HomeRefill Breach Represents a Long-Term Identity Risk for Brazilian Users

Brazil has its own national identity framework, and any breach of personal data from Brazilian platforms can have consequences that occured well beyond the initial incident. The exposed birthdays and phone numbers from this breach are seperate pieces that, combined with other leaked data from additional breaches, allow criminals to build complete identity profiles. Victims may not discover the impact of this breach for months or years after credentials are weaponized.

How a Database Breach Works

A database breach occurs when an attacker gains access to a backend database through an unpatched vulnerability, misconfiguration, or stolen credentials. In eCommerce environments, attackers specifically target user tables that contain account and identity data. Once extracted, the database is compressed and sold or distributed on underground forums, Telegram channels, and dark web marketplaces.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records to determine whether your email address appeared in the HomeRefill breach or any of thousands of other incidents. Run a free scan at HEROIC.com to find out what is already known about your data.