E-Commerce Customers Exposed: The InMovil Breach Leaked 43,782 Records

In June 2022, a database belonging to InMovil, a Spanish e-commerce platform specializing in mobile phones, was exfiltrated and surfaced on dark web forums. The breach exposed 43,782 unique email addresses along with full names, IP addresses, birthdays, and MD5 hashed passwords. The data was recieved by threat actors in a clean, structured format, pointing directly to a database-level compromise rather than a surface-level scrape.

What Attackers Can Do With MD5 Password Hashes and Personal Data

MD5 is a legacy hashing algorithm that is partcularly vulnerable to rainbow table attacks and modern GPU-accelerated cracking. Attackers who acquire this dataset can rapidly reverse a large percentage of the hashed passwords, then use those plaintext credentials in credential stuffing campaigns across email providers, banking platforms, and other e-commerce sites where users tend to reuse passwords. Combined with full names, birthdays, and IP addresses, the data also enables convincing phishing and social engineering attacks.

What Was Exposed in the InMovil Breach

• Email Address
• Password Hash (MD5)
• First Name
• Last Name
• IP Address
• Birthday

Why This Breach Puts Spanish E-Commerce Users at Ongoing Risk

Breaches involving birthday and IP address data alongside credentials are occured more frequently in the e-commerce sector and carry compounding risks. Fraudsters can use birthdays to pass identity verification checks, while IP data helps them narrow down geographic targeting for scams. For users who shopped at InMovil, the combination of fields in this breach is enough to enable account takeovers, fraudulent purchases, and identity theft across multiple platforms.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a backend database, typically by exploiting an unpatched vulnerability, a misconfigured server, or compromised administrative credentials. Once inside, the attacker can export entire tables of user records in seconds. The resulting dump is then packaged and sold or distributed on dark web marketplaces. In InMovil's case, the clean structure of the exported data suggests the attacker had direct query-level access to the production database, not just a partial web-facing exposure.

Check If Your Data Was Exposed

HEROIC's DarkWatch monitors over 400 billion exposed records, including breaches like InMovil, to alert you the moment your email or credentials appear in a new data dump. Search your email address now at HEROIC to find out if your data was part of this breach or any other known incident.