schenkYOU’s Breach Covers More People Than Live in Freiburg

HEROIC analysts identified a database breach affecting schenkYOU, a German online gift retailer, with data first leaked on August 15, 2024, and subsequently listed for sale on a prominent hacking forum in September 2024. The incident exposed 237,328 records containing email addresses, first names, last names, dates of birth, and salted SHA-256 password hashes. Following the breach, the standalone schenkYOU website was shut down and all traffic was redirected to their Amazon store.

Why This Is Dangerous

The schenkYOU breach combines personal identity data with password hashes in a way that enables multiple categories of attack. Salted SHA-256 hashes are more resistant to cracking than older algorithms, but weak or common passwords can still be recovered through dictionary attacks. More immediately, the combination of full name, email address, and date of birth gives attackers enough data to pass identity verification checks, answer security questions, and impersonate victims when contacting financial institutions or customer service departments. This data set is well-suited for targeted phishing, identity fraud, and social engineering attacks against the affected individuals.

What Was Exposed

• Email Address
• First Name
• Last Name
• Birthday
• Password Hash (salted SHA-256)

Why This Matters

Personal data breaches that include full names, birthdays, and email addresses create long-lasting risks. Unlike passwords that can be changed, a person's date of birth and full name are permanent identifiers that remain exploitable indefinitely. Attackers use this combination to open fraudulent accounts, apply for credit in victims' names, and bypass knowledge-based authentication at banks and government services. The 237,328 affected users also face credential stuffing risks if their schenkYOU password was reused on other platforms, since SHA-256 hashes for weak passwords can be cracked over time.

How Database Breaches Work

A database breach occurs when attackers gain unauthorized access to the systems where a company stores its user data. Common methods include exploiting SQL injection vulnerabilities in web applications, taking advantage of unpatched server software, or using stolen credentials to access administrative interfaces. Once inside, attackers can copy or export entire customer databases in minutes. The data is then packaged and sold or distributed on dark web forums, sometimes weeks or months after the initial theft, as occurred with the schenkYOU breach.

Check If You Are Affected

If you ever shopped at schenkYOU or created an account on schenkyou.com, your personal information and hashed password may be included in this breach. Use the HEROIC free breach scanner to check your email against our database of 400 billion or more compromised records and determine whether your data has been exposed.