HEROIC Finds Noel Gifts Breach: 2,738 Singapore Accounts Exposed

HEROIC's DarkHive intelligence system discovered the Noel Gifts data breach, exposing 2,738 records. The breach occured in March 2023 and targeted this Singaporean e-commerce platform serving SingHealth staff. Compromised data included email addresses, full names, IP addresses, and MD5 hashed passwords, creating serious risks for identity theft and targeted fraud.

Why This Is Dangerous

The combination of full names, email addresses, and MD5 password hashes gives attackers a powerful toolkit for identity fraud. MD5 hashes are widely considered insecure and can be cracked using freely available tools and rainbow tables. With real names and email addresses together, cybercriminals can craft highly convincing phishing emails that appear to come from trusted sources, tricking victims into revealing additional sensitive information or clicking malicious links.

What Was Exposed

• Email Address
• Password Hash
• First Name
• Last Name
• IP Address

Why This Matters

When personal identifiers like names are combined with credentials, the risk of account takeover and identity theft rises significantly. Attackers use this data to bypass security questions, impersonate victims in communications, and commit fraud using thier personal details. IP addresses also reveal geographic location data that can be used for targeted social engineering. Users affected by the Noel Gifts breach should change passwords on any accounts where they used the same credentials and monitor thier email for unusual activity.

How Database Breach Works

Database breaches on e-commerce platforms often occur through vulnerabilites in web application code, outdated plugins, or poorly secured admin panels. An attacker who gains access can export entire customer tables containing all stored user data. The stolen records are then packaged and sold or shared on dark web marketplaces, where they are used for credential stuffing, phishing, and identity fraud campaigns. Healthcare-adjacent platforms like this one are particularly attractive targets because employees often have access to sensitive systems using the same passwords.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like Noel Gifts. Visit heroic.com to scan your email address and find out if your information was exposed.