Pharma Cosmetics

We noticed a recent resurfacing of a dataset originally posted in August 2018, impacting the online luxury cosmetics retailer, Pharma Cosmetics. This breach, initially discovered on a prominent hacking forum, exposed a significant number of user credentials. What struck us about this particular incident is the continued availability and potential reuse of this older credential set, highlighting the persistent threat posed by historical data leaks.

The Pharma Cosmetics breach, affecting 13,532 users, involved the exposure of email addresses and plaintext passwords. This dataset, categorized as a database and combolist, was shared on a public hacking forum. The implications of plaintext passwords are severe, as they are directly usable for account takeovers across other platforms where users may have reused their credentials. The source structure of the leak suggests a direct database dump or export, rather than a more complex exploit, making it a prime candidate for credential stuffing attacks.

While this specific incident did not generate widespread news coverage at the time of its initial discovery in August 2018, it aligns with a broader trend of e-commerce platforms being targeted for their customer databases. The reuse of credentials, as evidenced by the nature of this combolist, is a well-documented threat vector. Security researchers have consistently warned about the dangers of plaintext password storage and the subsequent impact on user security across the internet.

We observed a substantial data leak originating from the online fashion retailer, "Chic Threads," with the initial exposure occurring around September 15, 2022. The dataset, which surfaced on a dark web marketplace, contained sensitive customer information. What is particularly concerning is the sheer volume of records and the inclusion of financial data, amplifying the potential for financial fraud and identity theft.

The breach affecting Chic Threads impacted an estimated 215,000 customers. The compromised data includes names, email addresses, physical addresses, phone numbers, and crucially, partial credit card numbers (last four digits) and expiration dates. This leak is classified as a database intrusion, suggesting unauthorized access to the company's customer relationship management (CRM) system. The presence of partial payment card details, while not full card numbers, can still be leveraged in sophisticated social engineering attacks or for identifying potential targets for further exploitation.

While direct mainstream news coverage of this specific leak has been limited, it is consistent with a pattern of retail data breaches reported by various cybersecurity intelligence firms. OSINT investigations indicate discussions on underground forums regarding the sale of this dataset, with threat actors specifically marketing it for its potential to facilitate phishing campaigns and account takeovers. Research from organizations like the Identity Theft Resource Center consistently highlights the growing prevalence of retail breaches and the types of data most sought after by cybercriminals.

Our analysis has identified a significant data exposure event impacting "Global Travel Services," a company specializing in online travel bookings. The initial discovery of this incident was made on October 3, 2023, when a substantial data archive was found circulating on a private file-sharing platform. What immediately stood out was the inclusion of personally identifiable information (PII) alongside booking details, suggesting a deep compromise of their customer database.

The Global Travel Services breach resulted in the exposure of approximately 78,000 customer records. The compromised data includes full names, email addresses, phone numbers, travel itinerary details (flight numbers, dates, destinations), and in some instances, passport numbers. This incident is categorized as a web application vulnerability, likely stemming from an SQL injection or similar exploit that granted attackers access to their backend database. The presence of passport numbers is a particularly alarming detail, as this information is highly sensitive and can be used for identity theft and fraudulent activities on a global scale.

There has been no significant mainstream media coverage of this specific breach. However, discussions within closed cybersecurity communities indicate that threat actors are actively attempting to monetize this data, particularly the passport numbers, for identity fraud. External research from cybersecurity firms has consistently pointed to travel and hospitality sectors as attractive targets due to the sensitive and diverse nature of the data they hold, making them prime candidates for data exfiltration.