VapePartsMart Data Breach: 137,617 Records With Phone Numbers

If your email address appears among the 137,617 records in the VapePartsMart data breach, the file ties it to a username, your name, a phone number, an IP address and a password hash. HEROIC analysts logged the record, dated June 5, 2022. Only a scan of your email can tell you whether you are in it.

Why a Hash Beside an Email Raises the Stakes

A password hash is the scrambled form of a password, and here it sits next to the very email address it belongs to. The record does not say how the hashes were made, so treat the passwords behind them as exposed. Anyone who reused one of those passwords elsewhere could see another login opened with it.

Seven Details Tied to Each Email Address

• Email address, the inbox that phishing messages would target.
• Username, a handle that helps match this record to other logins.
• First name, which personalizes a scam message.
• Last name, which with the first name makes impersonation easier.
• Phone number, the number a scam text or call could be aimed at.
• IP address, a detail that hints at where a connection came from.
• Password hash, the scrambled password, treated as exposed because its method is not named.

From a Stored Hash to a Taken-Over Login

Hashes can be attacked offline, with guesses run against them until one matches, so a reused or simple password may be recovered. Once it is, the same password can be tried on email and on other sites. Alongside it, the name and phone number give a fraudster what is needed to pose as the person convincingly, so identity impersonation and fraud attempts are possible from the same record.

How Records Are Copied Out of a Company's Database

This data breach involves records taken from one service's own systems, through a weakness in the software or the server that holds them. The copy captures every row in a table at once, so a single file can carry 137,617 entries. Nothing in the copy depends on malware running on the victim's own device.

What to Do If Your Address Is in the File

First, scan your email to see your information. If it matches, change your VapePartsMart password and any other password you reused, and watch for emails that pretend to come from VapePartsMart. For the phone number, watch for scam texts and calls and ask your carrier about a PIN. Run both a personal and a work address through the scan.