How the ShopBack Database Breach Led to 20 Million Stolen Profiles

HEROIC analysts identified the ShopBack breach, which occured in September 2020 and exposed 20,516,347 records from the Singapore-based cashback rewards platform. The leaked data spanned email addresses, phone numbers, password hashes, first and last names, IP addresses, and birthdays, representing one of the largest regional e-commerce breaches of that year.

What Attackers Can Do With ShopBack's Emails, Phone Numbers, and Birthdays

The combination of full names, phone numbers, birthdays, and email addresses makes ShopBack victims partcularly vulnerable to targeted phishing and SIM-swapping attacks. Fraudsters can impersonate victims when contacting mobile carriers, use birthdays to pass identity verification questions, and craft convincing spear-phishing messages using real personal details to gain access to banking or payment accounts.

What Was Exposed in the ShopBack Breach

• Email Address
• Phone Number
• Password Hash
• First Name
• Last Name
• IP Address
• Birthday

Why 20 Million ShopBack Records Create Long-Term Fraud Risk

SHA1 password hashes, even when salted, are accessable to attackers with modern GPU-based cracking rigs. Once cracked, those passwords feed directly into credential stuffing tools targeting banks, e-commerce sites, and email providers. The breadth of personal data also supports full identity reconstruction, enabling fraudsters to open new credit lines or commit financial fraud in victims' names years after the original incident occured.

How a Database Breach Works

A database breach happens when attackers gain unauthorized access to a company's data storage systems, often through SQL injection, exposed administrative interfaces, or compromised employee credentials. The attacker exports user records in bulk. In ShopBack's case, the exported database contained detailed personal and financial information across more than 20 million accounts, making it a high-value target for ongoing exploitation.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against 400 billion leaked records, including the ShopBack breach. Visit HEROIC.com to find out whether your data is circulating in underground markets right now.