Dark Web Intel: 17,572 Customer Credentials From the Petstop Database Dump

HEROIC analysts identified a database breach affecting Petstop, a US-based eCommerce platform that sells electronic pet containment systems. The breach surfaced on March 11, 2025, and exposed 17,572 customer records. The leaked data included email addresses, usernames, full names, phone numbers, and password hashes with salt values. Both bcrypt and salted MD5 hashing formats were found in the dataset. While the passwords are not in plaintext, the exposure of hashes alongside salt values creates a real risk for customers who use weak or commonly reused passwords.

Why Salted Password Hashes in the Petstop Dump Still Put Accounts at Risk

Password hashes store a scrambled version of the original password rather than the text itself. Adding a salt value makes mass cracking harder by ensuring each hash is unique. However, when both the hash and the salt are exposed together, an attacker can still target individual accounts with specialized cracking software. MD5 hashing is particlularly weak under modern hardware, which can test billions of password guesses per second. Bcrypt offers better resistance but is not immune to cracking if the underlying password is simple or predictable. Customers who reuse the same password across multiple websites face the greatest risk from this kind of exposure.

What Was Exposed in the Petstop Database Leak

• Email Address
• Username
• First Name
• Last Name
• Phone Number
• Password Hash (bcrypt and MD5 with Salt)
• Salt

Why This Matters for Petstop Customers

eCommerce breaches carry serious consequences because shopping accounts store shipping addresses, order histories, and sometimes saved payment methods alongside login credentials. A cracked password gives an attacker full access to a customer account, where they can harvest address data, redirect shipments, or use stored payment details to make unauthorised purchases. Phone numbers in the dataset open the door to smishing attacks, convincing text messages designed to extract sensitive information or lure recipients into clicking malicious links. Broader identity theft and financal fraud risks are present whenever a full name, phone number, and account credentials are exposed together.

How Database Breaches Hit eCommerce Platforms

Online retailers store customer records in backend databases that handle everything from logins to order fulfillment. Attackers reach these databases through SQL injection flaws in the website code, through stolen admin credentials, or by exploiting unpatched vulnerabilities in the platform's software stack. Once inside, the entire customer table can be copied in seconds. That data is then compiled into a file and shared or sold on dark web forums, where other criminals use it for credential stuffing, identity theft, and targeted phishing. eCommerce platforms are high-value targets precisely because their databases combine personal identifiers with account credentials in a single location.

Check If Your Petstop Account Was Part of This Leak

HEROIC's free breach scanner searches across more than 400 billion compromised records, including the Petstop database leak. If you have or had an account on Petstop, change your password immediately and update that same password anywhere else you have used it. Run a free check at HEROIC.com to find out whether your email address appeared in this breach or any other known data exposure.