Kilt and Kilts Breach Exposed 929K Shopper Records Including Birthdays

HEROIC analysts found that Kilt and Kilts, a US-based online retailer of traditional and contemporary kilts and accessories, suffered a database breach on March 10, 2025. The incident exposed 929,595 customer records, each containing a mix of personal identifiers including full names, email addresses, phone numbers, and dates of birth. No passwords were included in this particular dataset, but the combination of personal details present is more than enough to enable targeted fraud, impersonation, and social engineering against affected customers.

Why Losing a Birthday and Phone Number Is More Dangerous Than It Sounds

When people think about data breaches, they often focus on passwords. But a full name, email address, phone number, and birthday together form a profile that attackers find extremely usefull. Birthdays are frequently used as security verification answers by banks, insurance companies, and government services. Phone numbers allow attackers to initiate SIM swap attacks, taking over your mobile number and with it any two-factor authentication codes sent to your phone. Email addresses combined with real names make phishing messages look convincingly personal, increasing the chance that a target will click a malicious link or hand over more sensitive information without realizing the risk.

What Was Exposed in the Kilt and Kilts Breach

• Email addresses (929,595 records)
• First names and last names
• Phone numbers
• Dates of birth

Why This Matters for Online Shoppers

eCommerce customers are high-value targets for fraudsters because they have active payment methods on file, a demonstrated willingness to buy online, and often accounts with saved shipping addresses. Even without passwords in this breach, attackers can combine the exposed Kilt and Kilts data with information from other breaches to build richer profiles. This practise, known as data aggregation, allows criminals to piece together enough information to open fraudulent accounts, apply for credit in your name, or convince a customer service agent at another company that they are you. The risk extends well beyond Kilt and Kilts itself.

How eCommerce Database Breaches Happen

Online retail platforms store large volumes of customer data to support order processing, shipping, and account management. This makes them attractive targets for attackers. Common attack methods include exploiting vulnerabilities in shopping cart software, using stolen administrator credentials to access backend systems, or targeting third-party plugins and integrations that process customer data. Once inside a database, an attacker can extract hundreds of thousands of records in a matter of minutes. The data is then packaged and sold on dark web marketplaces or shared in private forums. Retail platforms that do not encrypt customer data fields or apply strict access controls are particularly vulnerable to this type of attack.

Check If Your Kilt and Kilts Data Was Exposed

HEROIC's free breach scanner cross-references your email address against more than 400 billion compromised records, giving you a clear picture of which breaches you are caught up in. If your data appeared in the Kilt and Kilts breach or any other known leak, you will see it in your results. Head to HEROIC.com and run a free scan today. No account required, and results are available instantly.