BeYoung 2025 Data Breach
The 2025 BeYoung data breach occurred in March 2025, when unauthorized actors gained access to the customer and order database infrastructure of BeYoung (beyoung.in), a major Indian direct-to-consumer fashion and apparel retailer.
Exposed Data Types
4- Email addresses
- Names
- Phone numbers
- Purchases
About This Breach
The incident resulted in the extraction of customer order records, which were subsequently distributed on breach intelligence forums.
What information was affected in the BeYoung incident?
The compromised dataset includes customer transaction and contact records, exposing 1,253,396 unique customer profiles. The exposed data categories include:
- Identity Details: Full customer names and internal customer identifiers.
- Contact Credentials: Canonical email addresses and mobile telephone numbers.
- Commerce Data: Purchase cart values, order transaction IDs, and order timestamps.
How many users were affected?
The validated and deduplicated email catalog contains 1,253,396 unique canonical email addresses extracted from over 5.56 million total raw purchase records.
Technical analysis and security implications
The dataset represents an unauthorized dump from the company's backend e-commerce order management system. While password credentials and payment card numbers were not identified in this dataset, the co-occurrence of customer names, verified phone numbers, emails, and recent shopping transaction values poses a substantial risk of targeted smishing, WhatsApp phishing, and courier delivery fee impersonation scams.
What actions should affected users take?
Customers who have purchased from BeYoung should:
- Remain alert against unsolicited SMS, WhatsApp, or email messages regarding delayed deliveries, extra courier charges, or fraudulent refund offers.
- Verify order statuses strictly via the official BeYoung application or website.
- Ensure multi-factor authentication (MFA / 2FA) is enabled on all primary email accounts.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
