BHF Couriers Data Breach
The 2024 BHF Couriers data breach occurred in April 2024 when internal customer and order databases from BHF Couriers (bhfcouriers.com.au), an Australian freight transport and logistics provider, were compromised and leaked online.
Exposed Data Types
7- Email addresses
- Names
- Passwords
- Phone numbers
- Physical addresses
- Partial credit card data
- Purchases
About This Breach
What information was compromised in the BHF Couriers incident?
The leaked databases (bhf-dev.csv, courier.csv) contain over 327,000 shipment bookings and user accounts. Verified data classes include:
- Customer Identifiers & Contact Details: Full customer names, email addresses, and phone numbers.
- Account Credentials: Unsalted MD5 password hashes.
- Physical Addresses & Delivery Records: Street delivery addresses, suburbs, states, and postal codes across Australia and New Zealand.
- Transaction & Payment Details: Partial credit card metadata (cardholder name, expiration month and year), purchase amounts, and billing invoices.
How many accounts were affected?
Standardized RFC 5322 ASCII canonical verification confirmed 277,955 unique valid email addresses across all customer and order tables.
Security advisory & personal identity protection
The exposure of MD5 password hashes alongside physical addresses and phone numbers creates high risks of parcel-delivery smishing scams and credential stuffing. Impacted users should:
- Reset passwords across external web services where identical credentials were used.
- Be cautious of unsolicited delivery notification texts or emails asking for personal verification or payments.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
