39,768 Swenson Park Golf Course Customer Records Posted on the Dark Web

39,768 customer records from Swenson Park Golf Course surfaced on a dark web forum on November 5, 2024. The dataset went well beyond a simple contact list -- it included birthdays, gender, addresses, player types, and even each customer's email and SMS marketing opt-in preferences. This level of detail transforms a golf course customer database into a ready-made toolkit for targeted phishing and identity fraud.

Why This Is Dangerous

Leisure and hospitality organizations collect rich customer profiles to power loyalty programs, booking systems, and marketing campaigns. That richness is exactly what makes their breaches dangerous. When attackers combine verified email addresses and phone numbers with birthdays, gender, and home addresses, they can build convincing fake identities, answer knowledge-based authentication questions, and craft hyper-personalized scam messages that reference real customer details to establish false trust.

What Was Exposed

• Email Address -- primary contact point for phishing and account recovery attacks
• Phone Number -- enables SMS phishing, SIM-swap fraud, and robocall scams
• First Name and Last Name -- enables personalized social engineering
• Birthday -- commonly used to verify identity, answer security questions, and open fraudulent financial accounts
• Gender -- adds profile granularity for targeted messaging
• Address and Zip Code -- sufficient for identity theft applications and physical mail fraud
• Player Type -- reveals customer behavior and spending tier
• Email and SMS Opt-In/Out Preferences -- helps attackers craft messages that bypass spam filters and appear legitimate
• Account Creation Date -- provides timeline context for social engineering

Total records exposed: 39,768. Breach date: November 5, 2024. Location: Stockton, California, United States.

Why This Matters

The breadth of this dataset creates risk across multiple attack categories simultaneously:

• Credential Stuffing: Email addresses are tested against banking, retail, and email platforms using passwords from other known breaches.
• Account Takeover: Phone numbers combined with email addresses enable SIM-swap attacks and bypass of SMS-based two-factor authentication.
• Identity Theft: Full names, birthdays, addresses, and gender together exceed the data threshold required to open credit accounts, apply for loans, or file fraudulent tax returns.
• Targeted Fraud: Marketing preference data allows attackers to mimic legitimate communications -- opt-in customers are accustomed to receiving emails and texts from the organization, making fraudulent lookalike messages far more convincing.

How Database Breaches Work

Database breaches targeting hospitality and leisure organizations typically exploit weaknesses in customer relationship management (CRM) systems or booking platforms -- often software that is outdated, misconfigured, or connected to the public internet without adequate access controls. Attackers may use SQL injection, stolen administrative credentials, or exposed backup files to extract the underlying database tables. The resulting datasets -- structured, consistent, and rich in PII -- are then packaged and posted on dark web marketplaces, where they command premium prices due to the volume and variety of exploitable data fields.

Check If You Are Affected

Heroic's breach intelligence database contains over 400 billion records from thousands of known data breaches worldwide. If your email address or phone number appeared in the Swenson Park Golf Course leak, you can find out in seconds.

Search now at heroic.com to check your exposure and get immediate guidance on protecting your identity and accounts.