The ZonBase Dump Contains Exactly 4,889 Email Addresses and IP Addresses

HEROIC analysts found the ZonBase breach while monitoring a known hacking forum, where a database dump occured on August 1, 2021. The exposed data covers 4,889 users of the ZonBase Amazon seller software platform, with records containing email addresses, first names, last names, and IP addresses for accounts based in the United States.

How Exposed Names, Emails, and IP Addresses Enable Targeted Fraud

With full names paired to email addresses and IP addresses, attackers can craft highly convincing spear-phishing emails that appear accessable and legitimate to recipients. For Amazon sellers, this is particularly dangerous because a single compromised seller account can be used to list fraudulent products, redirect payments, or drain advertising budgets.

What Was Exposed in the ZonBase Breach

• Email Address
• First Name
• Last Name
• IP Address

Why the ZonBase Breach Puts Amazon Seller Accounts in Danger

Business email compromise and account takeover are the primary risks when full names and email addresses are leaked together. Cybercriminals use this data for credential stuffing on Amazon Seller Central, Shopify, and other platforms, knowing that many sellers recieved no warning and may still be reusing the same credentials across multiple services.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a company's backend database, typically through SQL injection, exposed credentials, or misconfigured cloud storage. Once access is gained, the attacker exports user records in bulk. Those records are then sold or posted on hacking forums, where other criminals use them to fuel phishing campaigns, account takeovers, and identity theft.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against more than 400 billion records, including the ZonBase database. Find out in seconds whether your information is circulating among cybercriminals and take action before attackers do.