The Shop Tend Tudo Leak Means Scammers Could Be Texting You by Name

HEROIC analysts discovered a database dump tied to Shop Tend Tudo, a Brazilian e-commerce platform, when the file surfaced on underground forums on June 1st, 2023. The exposed dataset contained 49,815 records with customer contact details recieved directly from their backend systems. No passwords were included, but the combination of full names, email addresses, and phone numbers is more than enough for attackers to cause serious damage.

Scammers Could Already Be Impersonating Shop Tend Tudo to Reach You

With names, emails, and phone numbers in hand, attackers can send highly convincing phishing messages that look like they are coming from Shop Tend Tudo directly. They can reference your real name, mention a pending order, or claim there is a delivery problem. You get a text or email that looks completely legitimate, you click the link, and within minutes your credentials or payment details are gone. This is not hypothetical, it is the exact workflow that runs on this kind of data every single day.

What Was Exposed in the Shop Tend Tudo Breach

• Email addresses
• Phone numbers
• First and last names

Why Contact-Only Breaches Are Not Harmless

It is easy to assume a breach without passwords is a seperate, lower-tier threat. It is not. Full names paired with phone numbers and email addresses are a complete social engineering toolkit. Attackers use this data to build targeted phishing campaigns, cross-reference it with other leaked datasets to fill in gaps, and sell packaged profiles to fraud rings. Your inbox and your phone become the attack surface. Identity fraud does not always start with a cracked password. Sometimes it starts with someone knowing exactly how to address you by name.

How a Database Breach Works

A database breach happens when an unauthorized party accesses a company's data storage and extracts customer records. Common entry points include SQL injection vulnerabilities in the website, compromised employee accounts with database access, or insecure API endpoints that expose backend data. The attacker packages the extracted records and distributes them through dark web forums or private Telegram channels. E-commerce platforms are frequent targets because they hold large volumes of customer contact and transaction data in one accessable place.

Check If Your Data Was Exposed

HEROIC's free breach scanner indexes over 400 billion compromised records from breaches worldwide. Enter your email address to instantly find out whether the Shop Tend Tudo breach or any other leak has exposed your personal information. Free, fast, and no account required.