A cybercriminal is reportedly offering a Decathlon customer database containing around 160 million records for sale. This database was advertised on a cybercrime platform, with the seller accepting cryptocurrency as payment.
Alleged Data Breach Details
While the breach claims have not been independently verified, Decathlon has yet to confirm any compromise of its data systems. The forum post suggests that the database includes a wide array of personally identifiable information (PII) and account data. A supposed sample of the records was shared by the seller, but its authenticity and completeness remain uncertain.
Potential Impact of the Data Leak
The alleged database reportedly contains customer IDs, email addresses, password hashes, names, birth dates, contact information, and account preferences. If authentic, such a dataset could pose serious privacy and security risks to Decathlon customers globally. However, claims on such forums are often overstated or based on older data leaks, necessitating independent verification before confirming a Decathlon data breach.
The presence of password hashes is particularly noteworthy. Although password hashes are secure representations of passwords, weak or reused ones can be cracked, enabling attackers to perform credential-stuffing attacks. This involves using leaked credentials across various platforms to gain unauthorized access.
Protective Measures for Customers
Until the breach is confirmed or refuted, Decathlon customers should proactively secure their accounts. Steps include changing Decathlon passwords, especially if reused elsewhere, utilizing unique, strong passwords via a password manager, and enabling multi-factor authentication wherever possible. Customers should also scrutinize their account activity and be wary of unsolicited communications posing as Decathlon representatives.
Organizations should advise employees against using corporate credentials on consumer sites, as such breaches can lead to enterprise attacks through credential stuffing.
As of now, the purported Decathlon data breach remains unverified. Decathlon has not released an official statement addressing the hacker’s claims, and there is no independent evidence confirming the origins of the advertised records.
