Inside the Moon Valley Nurseries Database Breach: How 31,700 Customer Records Were Exposed

HEROIC analysts found a dataset linked to Moon Valley Nurseries surfacing on an underground forum in May 2023. The company, a well-known U.S. plant nursery and landscaping retailer, had roughly 31,700 customer records posted in what appears to be a direct database extraction. The exposed file was partcularly concerning because it combined contact information with demographic details, giving attackers a richer profile of each affected customer than a simple email leak would provide.

What Attackers Can Do With Customer PII From a Retail Database Dump

A retail database dump like this one hands attackers a ready-made contact list with real names and phone numbers attached. They can send SMS phishing messages that address you by name, impersonate Moon Valley Nurseries in follow-up calls, or use your birthdate to reset account PINs at banks and telecoms that use date of birth as a verification factor. Because this data includes both email and phone, attackers have two separate channels to try.

What Was Exposed in the Moon Valley Nurseries Breach

• Email addresses
• Phone numbers
• First and last names
• Dates of birth
• Gender
• Geographic location data

Why Retail Customer Data Is a Prized Target

Retail platforms collect detailed customer profiles to power loyalty programs, personalized marketing, and order histories. That same richness makes them highly accessable targets for threat actors. When a retailer's database is exposed, the result is not just a list of email addresses but a fully formed identity package. Victims face risks including phishing, account takeover on any service tied to that email, identity fraud, and social engineering calls from people who already know their name and birthday.

How a Database Breach Works

In a database breach, an attacker finds a weakness in a company's web application or server configuration and uses it to query the underlying customer database directly. This could be an SQL injection flaw, a misconfigured API endpoint, or a compromised admin credential. Once inside, the attacker runs a simple export command that pulls every row in the user table. The resulting file is then packaged and uploaded to forums where cybercriminals buy, sell, or freely distribute stolen data.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against more than 400 billion exposed records collected from known breaches worldwide. If you shopped at Moon Valley Nurseries or signed up for their services, your data may be in circulation right now. A quick scan at HEROIC.com will show you exactly what has been exposed and what steps you should take to protect yourself.