LuLu Data Breach

In this incident, the presence of a password field along with contact information significantly increases the risk. Even if passwords are not listed in plain text, hashed passwords can be attempted to be cracked by attackers, and if the same password is used on other accounts, it can lead to account takeover attempts. Email, phone, and address fields also allow the user to be targeted through different channels.

Purchase information can provide clues about the user's shopping history and delivery context. This information can be used in messages themed around fake shipping, returns, grocery coupons, membership points, order updates, or product delivery. Full payment card data is not listed in this record; however, when shopping and address context are combined, fraud attempts can become more convincing.

The record shows the incident date as July 6, 2024, with the number of affected records recorded as 2,796,835. Publicly available security news initially indicates that data of approximately 196 thousand customers was shared, and later a larger database backup also emerged. The existing data classes are compatible with this expanding scope, and the record is kept in a verified status.

While explaining the scope, two levels should be distinguished: the first visible leak contains limited customer information, and the subsequent larger data set includes more email and order context. Not all fields are expected to be present in each row. Additionally, the presence of hashed passwords does not mean the user's password is automatically known; however, it requires urgent measures against password reuse.

Users at risk are customers who have created an account, placed an order, or shared their phone number and delivery address on the LuLu online store or associated digital shopping channels. The risk is higher for those who use the same password on email, bank, social media, or other shopping accounts.

Since retail and grocery shopping are areas frequently engaged in, users are accustomed to messages about delivery, promotions, or loyalty programs. Attackers may use themes such as order numbers, delivery delays, or discount coupons in fake messages sent with real names and phone numbers. For this reason, links in SMS and messaging apps should be evaluated carefully.

Users in the matching field should immediately change the password for their LuLu account and separate all accounts where the same password is used one by one. Generating a unique password with a password manager is the most important step to prevent this incident from spreading to other accounts. Two-factor authentication should be enabled on every possible account.

For messages requesting cargo tracking, refunds, membership points, gift vouchers, or payment corrections, the process should be verified through the official app or a known web address before clicking any links. Even if the caller knows your name, address, or previous order information, verification codes and payment information should not be shared. If a suspicious transaction is observed, the bank and the relevant platform should be informed through a separate channel.

In the long term, password reuse on retail accounts should be completely avoided. Using different email aliases for shopping sites makes it easier to understand which platform is the source of a risk. Cleaning up unused addresses, old phones, and unnecessary saved delivery information also reduces the amount of data that could be exposed in future breaches.

In breaches involving hashed password data, it is not sufficient to protect only the affected store account. The user's email account, payment services, shipping accounts, and all services where the same password is used should be evaluated separately. Account recovery email and phone number should be kept up to date, and suspicious login alerts should be enabled.

The check performed on LeakData shows whether the user's email address appears in the data associated with the LuLu breach. If a positive result is obtained, the user should immediately eliminate password reuse and be cautious of fake shipping and campaign messages, assuming that their phone and address information could be misused.

A negative result means that there is no match within this record; it does not prove that the user is secure across all retail accounts. It should be periodically checked whether the same email address appears in different violations, and strong passwords and two-step verification should be standardized for shopping accounts.