Is Your Email in the Minted.com Leak? 3,078,993 Records Exposed

HEROIC analysts identified a file tied to Minted.com, a retail marketplace, dated 06-May-2020. The file contains 3,078,993 records made up of email addresses, usernames and password hashes pulled directly from Minted.com's own systems. The only way to know for certain whether your details are part of this file is to scan your email.

What a Username and Password Hash Combination Enables

On their own, a username and an email address are enough to build a convincing phishing message that references a real account on a real retail site. Add a password hash, and an attacker gains a second avenue: attempting to crack it offline, then testing the recovered password against other accounts the same person likely owns. Shoppers who reuse one password across several retail and email accounts are the ones most exposed by a file like this.

The Three Fields Found in This Retail Marketplace File

• Email Address: gives an attacker a confirmed contact point for phishing tied to this retailer.
• Username: can be matched against other platforms to track down a person's other accounts.
• Password Hash: not readable as is, but can potentially be cracked and reused if you repeat passwords elsewhere.

Where This Kind of Exposure Leads

A recovered password from this file can open other accounts that share it, leading to unauthorized orders, changed shipping details, or a locked out inbox. The combination of a real username and email also makes targeted phishing more convincing, since a scammer can reference an actual order history or account name instead of guessing. None of this requires any further breach beyond what is already in this file.

How a Retailer's Customer Database Gets Exported Like This

This record set reportedly came directly from Minted.com's own customer database rather than from a mix of unrelated sources. In a breach like this, an attacker typically finds a way into the retailer's backend systems, through a vulnerable application, a stolen employee credential or a misconfigured server, and then exports the full customer table at once. That differs from a list assembled from many smaller leaks, since every record here points back to one retailer.

Finding Out if You Are in This Minted.com File

The quickest way to check is to scan your email against this 3,078,993-record file. If your address turns up, change the password on your Minted.com account and anywhere else it was reused. Run the check on both personal and work email addresses, since either could have been used to sign up for a retail account like this one.