One Shopping Password Could Unlock 224,970 Accounts

HEROIC's threat intelligence operations uncovered a stealer log file titled "225K Shopping Target" circulating on Telegram since March 2023. This massive dataset contains 224,970 compromised credential records specifically targeting users of e-commerce and online shopping platforms. Shopping accounts are high-value targets because they typically store payment cards, shipping addresses, and purchase histories that attackers can exploit for fraud and identity theft.

224,970 Plaintext Passwords to Shopping Accounts

Every password in this dataset is stored in plaintext, fully readable without any decryption. When these plaintext credentials belong to shopping accounts, the risk goes far beyond simple unauthorized logins. Each compromised account may contain saved credit card information, default shipping addresses that reveal home locations, and complete purchase histories that provide a detailed profile of the victim. With nearly 225,000 shopping credentials in plaintext, this dataset is a treasure trove for both financial fraud and targeted identity theft.

What Was Exposed

• Email Addresses — accounts registered on e-commerce platforms with associated payment and personal data
• Plaintext Passwords — unencrypted credentials granting direct access to shopping accounts with stored payment methods
• URLs — the specific online retailers and shopping platforms where each credential was captured

Shopping Credentials Are Gateways to Financial Fraud

Credential stuffing with shopping platform credentials is uniquely profitable for attackers. They log into compromised accounts, place orders using the victim's stored payment methods, and have goods shipped to alternate addresses for resale. With 224,970 credentials to work from, even a small success rate translates to significant financial losses across the affected user base. Attackers also use compromised shopping accounts to purchase high-value gift cards, which are easily laundered and nearly impossible to trace once redeemed.

How Shopping Credentials End Up on Telegram

Infostealer malware is the engine behind this dataset. Victims were infected through fake shopping deals, counterfeit coupon browser extensions, phishing emails disguised as order confirmations, and malicious ads on shopping comparison sites. The malware captured login credentials as users signed into their favorite retailers, extracting saved passwords from browsers and intercepting checkout forms. The stolen data was then filtered by domain type to isolate shopping and e-commerce credentials, creating the targeted "225K Shopping Target" collection that was shared on Telegram for financial fraud operators.

Check If Your Credentials Were Exposed

HEROIC's breach intelligence database contains over 400 billion records from data breaches, stealer logs, and dark web sources. If you shop online, use the HEROIC breach scanner to check whether your email or password appears in the 225K Shopping Target dump. If you find a match, change your password on all shopping platforms immediately, remove stored payment methods, check your bank statements for unauthorized charges, and enable two-factor authentication on every e-commerce account you use.