Inside the Reported IKEA Data Breach: 429,002 Records With Hashes

HEROIC analysts logged a reported data breach record for IKEA, dated May 18, 2026. The claim covers 429,002 records listing email addresses, usernames, first and last names, phone numbers and password hashes. The breach has not been confirmed, so the only way to know whether your own information is included is to check your email.

Why a Claimed Breach Still Deserves a Check

An unconfirmed claim is not proof, but it is not a reason to wait either. If the record is accurate, it pairs a name and a phone number with a password hash, a combination that supports convincing messages. Checking costs nothing and settles the question for your own address.

The Six Details Claimed in the IKEA Record

• Email addresses, which a scammer can use for messages that mention the brand.
• Usernames, which help connect this record to profiles on other sites.
• First names, used to open a scam message with a personal greeting.
• Last names, which support impersonation once a first name is known.
• Phone numbers, a target for scam calls, texts and SIM swap attempts.
• Password hashes, scrambled passwords that an attacker may try to recover with cracking tools.

What a Password Hash Does and Does Not Protect

A hash is not the password itself, but it is not a safe place for one either. How hard it is to crack depends on the method used, and this record does not say which method that was. Anyone who reused the same password elsewhere should treat it as exposed until it has been changed.

How a Claimed Database Breach Works

A database breach is a copy of records taken from one service's own systems. It is not a stealer log, which comes from an infected device. Because the copy is bulk, it can list people who never made a mistake, and a report like this one can appear before any confirmation.

Is Your Email Among the Claimed IKEA Records?

To find out, scan your email and see what was reported. If you find a match, change the password for that service and for any site where you used the same one. Watch for emails and texts that pretend to be from the brand, and ask your carrier about a PIN on your phone line.

A work address deserves the same check as a personal one.