312,671 people from Subito Disponibile had their personal data exposed

In March 2023, 312,671 users from Subito Disponibile, an Italian eCommerce platform, had their personal data exposed in a significant database breach. The leaked records included email addresses, password hashes, full names, phone numbers, and dates of birth, giving attackers a detailed profile of each affected user. Security researchers occured across the exposed dataset on underground forums, where it was being actively distributed among threat actors targeting European online shoppers.

Why Exposed eCommerce Data Puts You at Risk

When an eCommerce platform leaks password hashes alongside names, phone numbers, and birthdays, attackers gain the tools to impersonate customers, take over accounts, and conduct targeted phishing campaigns. The combination of a date of birth with a phone number is partcularly useful for bypassing identity verification processes on banking and financial platforms. Subito Disponibile users who have not rotated their passwords or monitored their accounts face ongoing risk of account takeover and identity fraud.

What Was Exposed in the Subito Disponibile Breach

• Email Address
• Password Hash
• First Name
• Last Name
• Phone Number
• Birthday

Why the Subito Disponibile Breach Still Matters Today

Stolen eCommerce data retains its value long after the initial breach, as personal identifiers like names, phone numbers, and birthdays do not change the way passwords do. Criminals continue to trade and combine leaked datasets to build increasingly detailed identity profiles, making victims more vulnerable to sophisticated fraud over time. Users affected by the Subito Disponibile breach should remain vigilant for unusual activity across any account that shares data with their compromised records.

How Database Breaches Work

A database breach occurs when attackers gain unauthorized access to a company's stored data by exploiting vulnerabilities such as unpatched software, weak authentication controls, or misconfigured database permissions. Once access is established, entire tables of user records can be extracted within minutes using automated tools. The resulting datasets are then sold on dark web markets or published freely to maximize damage to the affected organization and its users.

Check If Your Data Was Exposed

HEROIC's breach intelligence platform tracks over 400 billion records from thousands of incidents worldwide, including the Subito Disponibile leak. Check your exposure for free through HEROIC to find out whether your email address or personal data was part of this breach, and get actionable recommendations to protect yourself from credential theft and identity fraud.