85,260 NicoVIP Customer Records Leaked With Names and Email Addresses

HEROIC analysts found records belonging to 85,260 NicoVIP customers circulating on a dark web marketplace in March 2025. The breach, dated March 8, 2025, originated from a direct database compromise at NicoVIP, a French e-commerce platform selling electronic cigarettes, e-liquids, and vaping accessories. The exposed dataset contained full names and email addresses for each affected customer, structured in a way consistent with a clean database export rather than a scraped or assembled file.

Why NicoVIP Customer Data Is Valuable to Attackers

Even without passwords in the mix, a dataset containing real names and email addresses is highly usefull to cybercriminals. Attackers now have a verified list of real people with active email accounts who are customers of a specific type of retailer. That is enough to launch targeted phishing campaigns, impersonating NicoVIP with fake order confirmations, refund notices, or account alerts designed to trick victims into handing over passwords or payment details.

Full names combined with email addresses also make identity profiling easier. Criminals can cross-reference this data against other leaked datasets to build more complete profiles of individuals, increasing the risk of identity theft and social engineering attacks that go far beyond a single compromised account.

What Was Exposed in the NicoVIP Breach

• Email Address
• First Name
• Last Name

Why This Matters for NicoVIP Customers

Database breaches at eCommerce platforms are among the most common vectors for downstream fraud. When customer records leave a retailer's database, they typically end up traded or sold across multiple criminal forums, meaning the same data can be exploited by many different bad actors over months or years. A customer whose name and email appear in this breach may start receiving convincing phishing emails not just from fake NicoVIP messages but from attackers who have combined this data with other sources.

The risk of credential stuffing is also present even when no passwords are leaked directly. Attackers use verified email lists from breaches like this one to narrow their targeting in other attacks, testing those email addresses against known password databases from unrelated leaks. Financail fraud and account takeover remain real risks for anyone named in this dataset.

How eCommerce Database Breaches Happen

eCommerce platforms store customer records in databases that power their online stores. These databases contain everything a business needs to process orders and communicate with buyers, including names, email addresses, shipping details, and purchase histories. When a vulnerability exists in the website's software, its hosting environment, or its third-party integrations, attackers can exploit it to extract the database contents directly.

This type of attack, known as a database compromise or SQL injection attack, often goes undetected for days or weeks because it leaves minimal traces compared to ransomware or other disruptive attacks. The attacker quietly copies the data and disappears. Victims often do not learn their information was taken until the data surfaces for sale on a dark web forum, as happened here with NicoVIP.

Check If Your Data Was Exposed in the NicoVIP Breach

HEROIC's free breach scanner checks email addresses against a database of more than 400 billion compromised records, including eCommerce breaches like the one affecting NicoVIP. If your email appears in this breach or any other known incident, you will receive an immediate alert. Use HEROIC's free tool now to find out in seconds and take action before anyone else uses your personal information against you.