Cheerleading Company Data Breach
The 2021 Cheerleading Company data breach occurred in January 2021 when unauthorized threat actors breached the online e-commerce platform of Cheerleading Company (cheerleading.com), a prominent Dallas, Texas-based manufacturer and supplier of cheerleading uniforms, team apparel, and school spirit wear operating since 1969.
Exposed Data Types
3- Email addresses
- Names
- Passwords
About This Breach
The incident resulted in the unauthorized extraction of customer account profiles and order history records from the company's X-Cart database.
What information was affected in the Cheerleading Company incident?
The compromised export of the xc_profiles customer table affected 66,527 unique customer profiles, exposing the following categories of personal information:
- Contact Credentials: Canonical email addresses (used as the primary login credential).
- Personal Identifiers: Customer full names and system profile IDs (profile_id).
- Security Credentials: Cryptographic password hashes stored in SHA-512 format alongside password reset tokens.
- Transactional Telemetry: Associated order identifiers (order_id), account creation dates, and last login activity timestamps.
How many accounts were affected?
Rigorous deduplication confirmed 66,527 unique canonical email addresses across 147,328 raw customer profile and guest checkout records.
Technical analysis and security risks
The leak originates from the core profile store of the enterprise X-Cart platform. While passwords were encrypted using SHA-512, the conjunction of email addresses with physical ordering activity exposes coaches, athletic directors, and consumers to package delivery scams, fake sporting goods promotions, and targeted spear-phishing campaigns.
Recommended actions for affected users
Customers who registered or placed orders through Cheerleading.com should:
- Promptly change passwords across any other online portals where their Cheerleading.com credentials were used.
- Treat unsolicited delivery notifications or payment dispute inquiries with scrutiny.
- Utilize password management tools to create unique passwords and enable two-factor authentication (2FA / MFA) wherever available.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
