The SafirStores Breach Happened in October. 59,199 Records Exposed.

HEROIC analysts identified a leaked dataset attributed to SafirStores, an Iran-based ecommerce platform, dated October 6, 2025 and circulating on a hacking forum. The dataset contains 59,199 unique email addresses paired with phone numbers, full names, genders, birthdays, and IP addresses. This incident has not been independently verified as a breach of SafirStores' own systems, so we're treating it as a leaked dataset tied to the platform rather than a confirmed corporate breach.

Why This Is Dangerous

No passwords appear in this dataset, but that doesn't make it harmless. Attackers who get a person's full name, birthday, phone number, and email address have everything they need to build a convincing phishing message or impersonate a real SafirStores order. Combined with gender and date of birth, this kind of data is also a building block for identity theft, since it matches the exact information many companies use to verify who you are over the phone or online.

What Was Exposed

• Email addresses
• Phone numbers
• First and last names
• Gender
• Date of birth
• IP addresses

Why This Matters

Even without passwords, this data feeds directly into account takeover attempts. Scammers often use a real name, phone number, and birthday to trick customer support agents into resetting a password or unlocking an account, a tactic that works far better than a random guess ever could. The email addresses in this dataset can also be matched against other leaked credential lists, letting attackers try known passwords from other breaches against the same accounts, a technique called credential stuffing.

How Database Breaches Happen

A database breach happens when an attacker gains direct access to the storage system behind a website, often through a vulnerability in the site's code, a misconfigured server, or stolen administrative credentials. Instead of tricking individual users, the attacker pulls entire tables of customer records at once. That's typically why database breaches expose so many accounts in a single incident and why the resulting data often ends up traded or sold as a complete package on forums like the one where this SafirStores dataset appeared.

Check If You Are Affected

If you've ever placed an order with SafirStores or used the same email address across multiple online stores, it's worth finding out whether your information appears in this or any other leaked dataset. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can see your exposure in seconds and take action, like updating a password or watching for phishing attempts, before someone else uses your data first.