If You Shop Online, the Sharp Target Leak Affects You

HEROIC identified a stealer log called Shopping Sharp Target that was uploaded to Telegram in December 2022. The file contains 599,160 records specifically curated from online shopping platforms, with each entry exposing an email address, a plaintext password, and the URL of the targeted e-commerce site. If you have ever saved your login on an online store, this leak could directly affect you.

Readable Passwords Mean Instant Account Access

The passwords in this dump are not hashed, salted, or encrypted in any way. They appear in plaintext exactly as users entered them, making exploitation trivially easy. Any attacker who downloads this file can begin logging into accounts within moments, no technical tools or cracking software required.

What Was Exposed

• Email addresses used to register on shopping and e-commerce websites
• Plaintext passwords exposed in their original, readable form
• URLs identifying the specific online stores and shopping platforms targeted

Shopping Accounts Hold More Than You Think

Online shopping accounts frequently store saved credit cards, billing addresses, purchase histories, and phone numbers. When attackers use credential stuffing to break in, they gain access to all of this sensitive data. They can make unauthorized purchases, steal payment details, or use the personal information for targeted phishing and identity fraud. With 599,160 records available, the number of potential victims is enormous.

Infostealer Malware: The Source of the Stolen Data

This dataset was assembled by infostealer malware running on infected user devices. These programs capture credentials stored in web browsers as users log into shopping sites, banking portals, and email accounts. The extracted data is organized into log files and distributed through Telegram groups, giving cybercriminals access to a constantly refreshed stream of stolen credentials.

Check If Your Credentials Were Exposed

Anyone who shops online could have their credentials in the Sharp Target leak. Use the HEROIC breach scanner to check your email against more than 400 billion compromised records. If your credentials appear, change your shopping site passwords immediately, remove saved payment methods from compromised accounts, and enable two-factor authentication wherever available.