Attackers Cracked Primusoff and Walked Off With 5,023 Logins

HEROIC found 5,023 records from Primusoff surfacing on dark web marketplaces on March 4, 2025, exposing email addresses, usernames, and PHPass-hashed passwords from the Russian eCommerce platform at primusoff.ru. The structure of the dump points to a direct database export, and credential stuffing activity linked to the same dataset started appearing across unrelated services within days.

Why This Primusoff Database Breach Is Dangerous

Primusoff stored credentials using PHPass, an older hashing library that falls quickly to modern GPU cracking rigs and precomputed wordlists. That means the 5,023 username and password hash pairs should be treated as effectively plaintext. Anyone who reused their Primusoff password on email, banking, marketplaces, or work accounts is at immediate risk of account takeover.

What Was Exposed in Primusoff

• 5,023 Primusoff user records from the eCommerce database
• Email addresses tied to active customer accounts
• Usernames used for login and order history
• Password hashes generated with the weak PHPass algorithm

Why This Matters

Credential stuffing crews love eCommerce dumps because shoppers often recycle the same password across retailers, Gmail, and payment wallets. With Primusoff emails and cracked passwords in hand, attackers can empty loyalty balances, reroute shipments, or pivot into linked payment providers. Russian-language phishing against these users is also highly likely given the targeted demographic.

How an eCommerce Database Breach Like This Works

Attackers typically probe eCommerce backends for outdated CMS plugins, exposed admin panels, or SQL injection in search and checkout flows. Once inside, they export the users table directly and walk off with the entire credential set. The Primusoff dump has all the hallmarks of that playbook, with a clean export structure and no evidence of selective filtering before upload.

Check If You Are Affected

If you have ever placed an order on primusoff.ru, search HEROIC's 400B+ record breach index to see if your email is tied to this leak. A quick lookup lets you rotate any reused password before attackers run the hash against your other accounts.