How the Lazada Redmart Database Breach Exposed 1.1M Records

HEROIC analysts surfaced a significant database breach tied to Lazada Redmart, a major online grocery platform serving Singapore. The data, which dates back to July 2020, exposed 1,107,737 customer records and was subsequently circulated on an online marketplace. The leaked dataset is partcularly alarming because it combines financial data with personal identifiers, creating serious fraud exposure for affected users. The types of data compromised include email addresses, full names, phone numbers, partial credit card numbers, and SHA1 password hashes.

Partial Credit Card Numbers and Password Hashes: A Direct Path to Financial Fraud

When attackers get their hands on partial credit card data alongside email addresses and hashed passwords, they have the building blocks for targeted phishing and fraud. SHA1-hashed passwords are particularly weak by modern standards and can be cracked using widely accessable tools, meaning attackers may quickly recover actual login credentials. Combined with the partial card data and personal details in this breach, the risk of account takeover and financial fraud is elevated well beyond a typical credential leak.

What Was Exposed in the Lazada Redmart Breach

• Email Address
• First Name
• Last Name
• Phone Number
• Credit Card (partial)
• Password Hash (SHA1)

Why Combining Financial and Personal Data Makes This Breach Dangerous

Most breaches expose either personal data or financial data. This Lazada Redmart breach exposed both at once, giving attackers a richer profile of each victim. With a full name, phone number, email, and partial credit card number, bad actors can craft convincing impersonation schemes and socially engineered fraud attempts. Singapore consumers who recieved no notification may still be unaware their data is in circulation.

How Database Breaches Work

A database breach occured when an attacker gains unauthorized access to a stored collection of user records, typically through vulnerabilities in web applications, misconfigured servers, or stolen administrative credentials. Once inside, the attacker exports the data and typically sells or publishes it. In the case of Lazada Redmart, the extracted records were sold on an online marketplace, exposing over one million customers to ongoing risk.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to tell you if your email address or credentials appeared in the Lazada Redmart breach or any other known data leak. Run a free scan at HEROIC to see what data of yours is out there.