Inside the Q-Depot Database Dump: How a SQL Attack Exposed 101,949 Customer Records

HEROIC analysts identified a database dump linked to Q-Depot, a Hong Kong-based e-commerce platform specializing in Korean and Japanese cosmetics, in February 2025. The breach exposed approximately 101,949 customer records pulled from a database containing roughly 500,000 lines of data. The combination of personal identifiers, contact details, and hashed passwords makes this dataset highly useful for targeted fraud and account takeover campaigns.

What Attackers Can Do With This Data

Q-Depot customers did not just lose their passwords. They lost a full identity profile. An attacker holding your name, email, phone number, IP address, and password hash can pursue several angles at once: phishing calls using your real name, targeted email scams that appear to come from Q-Depot, and password cracking attempts on the bcrypt hashes if weak passwords were chosen. The IP address also narrows down your general location, adding another layer of personalization to social engineering attempts. For anyone who reused their Q-Depot password on other platforms, the risk extends to every account that shares it.

What Was Exposed

• Email Address: Used to contact victims and attempt account logins on other platforms
• Phone Number: Enables voice phishing and SMS-based scams
• Password Hash (bcrypt): Crackable if the original password was weak or commonly used
• First Name and Last Name: Makes phishing communications appear legitimate
• IP Address: Reveals approximate geographic location at time of account use

Why This Matters: E-Commerce Breaches Feed Identity Theft and Account Takeover

E-commerce platforms are attractive targets because their databases combine two things attackers want most: contact information and credentials. Once an attacker has your email and a cracked or reused password, they can attempt logins on banking apps, payment platforms, and other retailers. Your phone number enables SMS interception attacks, which can bypass two-factor authentication on some services. The full-name data makes every downstream phishing attempt far more convincing. Q-Depot customers should treat this breach as a signal to audit every account that shares the same password or phone number.

How E-Commerce Database Dumps Happen

A database dump occurs when an attacker gains unauthorized access to a company's back-end database and extracts its contents in bulk. The most common entry points are SQL injection attacks, where malicious code is inserted into web forms to force the database to reveal its data, and compromised administrative credentials, where an attacker obtains a login with direct database access. E-commerce platforms are especially vulnerable because they process high transaction volumes across customer-facing interfaces, creating more potential entry points. Once inside, the attacker typically exports customer tables containing names, emails, phone numbers, addresses, and hashed passwords, then packages the data for sale on dark web forums or private Telegram channels.

Check If Your Q-Depot Account Was Exposed

HEROIC's free breach scanner checks your email against more than 400 billion compromised records, including e-commerce database dumps like Q-Depot. If your information appeared in this breach, you will see it immediately. Run a free scan at HEROIC and find out exactly where your data has been exposed before someone else acts on it.