NS Catalog Breach Fuels Credential Stuffing Against 109,965 Accounts

HEROIC investigators flagged the NS Catalog data breach after the Russian e-commerce platform's database dump appeared online on January 1, 2025. The leak contained 109,965 records, each pairing an email address with a password hash. Within days, HEROIC telemetry detected a corresponding spike in credential stuffing attempts against enterprise applications and consumer services worldwide.

Why This NS Catalog Database Breach Is Dangerous

The real-world consequence of this breach is already visible: attackers are actively replaying NS Catalog credentials against higher-value services. Because password reuse remains rampant, a single leaked shopping-site password often unlocks email, banking, streaming, and corporate SaaS accounts that share the same login. Password hashes stored without strong salting and modern algorithms can be cracked quickly on GPU rigs, giving attackers plaintext credentials that work in the wild.

What Was Exposed in NS Catalog

• 109,965 email addresses tied to NS Catalog shopper accounts
• Password hashes in an undocumented format
• Records sourced from a direct database compromise
• Actively circulating on dark web forums and underground marketplaces

Why This Matters

Credential stuffing is the direct downstream consequence of this leak, with documented attempts rolling across financial portals, corporate VPNs, and major email providers. Affected NS Catalog shoppers face account takeover, identity theft, and fraudulent purchases on any service where they reused the compromised password. The leak also fuels targeted phishing in Russian-language markets, with attackers impersonating NS Catalog to request payment updates or account re-verification.

How Database Breaches Work

E-commerce database breaches often start with SQL injection, an exposed admin endpoint, or server-side request forgery that grants an attacker direct read access to the user table. From there, the entire catalog of hashed credentials can be exfiltrated in a single request. The dumped data is posted to forums like BreachForums or XSS, where other criminals download it, crack the hashes, and weaponize the plaintext pairs inside automated credential stuffing tools.

Check If You Are Affected

HEROIC maintains visibility into more than 400 billion compromised records across surface web leaks, dark web dumps, and active stealer logs. Run a free scan to find out whether your email appeared in the NS Catalog breach and to see every other dataset where your credentials may still be circulating.