Boutiqat Data Breach Exposes 3 Million Users

The Kuwaiti beauty e-commerce giant, Boutiqat, has become the latest victim of a significant data breach, with sensitive data from over 3 million users being advertised for sale on a dark web forum. The compromised information includes names, email addresses, dates of birth, gender, phone numbers, and detailed shipping and billing addresses. The database also reportedly contains account details such as account creation dates, website store names, and other critical personal identifiers.

Company Overview

Boutiqat is a leading social e-commerce platform in the Middle East, specifically focusing on the beauty and fashion industry. Established in Kuwait, Boutiqat has rapidly grown into one of the region's most influential e-commerce brands, doubling its valuation to an impressive $500 million in recent years. The platform is well-known for its unique business model, which combines traditional e-commerce with social media elements, allowing influencers to curate and promote products directly to their followers.

Breach Details

The breach was first reported on September 1, 2024, when a hacker, operating under the alias "Satanic," listed the database for sale on a well-known dark web marketplace. The hacker claimed to possess the full Boutiqat database, which includes data from over 3 million users. The asking price for the database is $1,500, with full access to the database offered at $2,500.

The data being sold appears to include comprehensive customer profiles, which could potentially be used for a wide range of malicious activities, including identity theft, targeted phishing attacks, and financial fraud. According to the post, the database contains the following fields:

• User ID
• Name
• Email address
• Date of birth
• Gender
• Account lock status
• Website store name
• Group ID
• Default shipping and billing addresses
• Phone numbers
• Country and city

The availability of such detailed personal information poses a significant threat to the affected individuals, particularly given Boutiqat's large user base in the Middle East, where the company has established a strong market presence.

Threat Actor Profile

The hacker behind this breach, known as "Satanic," is a relatively new but active figure in cybercrime forums. Since joining in September 2023, Satanic has gained a reputation for selling high-profile databases and engaging in various other cybercriminal activities. The identity and location of Satanic remain unknown, as they operate under the cloak of anonymity typical of dark web actors.

Impact Analysis

The impact of this data breach could be far-reaching for Boutiqat and its users. For the company, this breach could lead to significant reputational damage, loss of customer trust, and potential financial penalties, particularly if it is found that the company did not adequately protect user data in compliance with data protection regulations.

For the affected users, the exposure of sensitive personal information increases their risk of falling victim to identity theft and various forms of cybercrime. Given that this data includes full addresses and contact details, there is also a concern about physical security for some users.