Loading story…
Spanish technology retailer PcComponentes denied claims that attackers stole a customer database affecting roughly 16 million users after a threat actor, “daghetiaw,” alleged theft of 16.3 million records, leaked a sample (reported as ~500,000 records), and offered the remainder for sale. The allegedly exposed data was described as including customer PII and commerce/support artifacts such as names, physical addresses, phone numbers, IP addresses, order details, wish-lists, and customer support messages (including exchanges via Zendesk). PcComponentes stated its investigation found no evidence of unauthorized access to its databases or internal systems and disputed the claimed scale, noting the number of active accounts is significantly lower; it also said it does not store customer passwords or financial details.
PcComponentes confirmed it experienced a credential stuffing attack, in which attackers attempt logins using reused email/password pairs sourced from other breaches. Threat intelligence firm Hudson Rock assessed the credentials likely originated from endpoints infected with info-stealing malware, aligning with the credential-reuse pattern. In response, PcComponentes implemented additional controls including CAPTCHA on login pages, mandatory 2FA for all accounts, and session invalidation requiring users to re-authenticate and enable 2FA.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In response to the account compromise activity, PcComponentes added CAPTCHA to login pages, required two-factor authentication for all accounts, and invalidated all active sessions. Customers were forced to re-authenticate and enable 2FA before regaining access.
PcComponentes said its investigation found no evidence of unauthorized access to its databases or internal systems and disputed claims that 16 million customers were affected. The company confirmed instead that it had experienced a credential stuffing attack affecting a small number of accounts.
Threat intelligence firm Hudson Rock assessed that the credentials in the leaked sample likely came from infostealer-malware infections rather than a direct breach of PcComponentes. It noted that some of the email addresses appeared in existing infostealer logs dating back to 2020.
A threat actor using the name "daghetiaw" claimed to possess 16.3 million PcComponentes customer records, leaked a sample of about 500,000 records, and offered the remaining data for sale. The sample allegedly contained customer, order, and Zendesk support-related information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor using the alias **"Jeffrey Epstein"** claimed to have stolen data on more than **400,000 Belgian customers** of Dutch online retailer **Bol** and advertised the dataset for sale on a dark web forum. Reports said the actor published a sample to support the claim and directed prospective buyers to negotiate through **Telegram** or **Session**. The allegedly exposed records include names, birthdates, phone numbers, email addresses, physical and shipping addresses, tracking numbers, order history, and some payment-related details, though reports said **passwords and bank or financial data were not included**. Bol said it was taking the claim seriously but had **no evidence of a hack or attack**, that its systems were operating normally, and that **no ransomware** was involved; if the data is genuine, it could be used in phishing, identity theft, and fraud targeting affected customers.
Jun 29, 2026
European DIY e-commerce platform **ManoMano** disclosed a large-scale data breach after threat actors compromised a **third-party customer service provider (subcontractor)**, leading to the unauthorized extraction of customer data tied to accounts and support interactions. The incident was identified in **January 2026** and affects roughly **38 million** customers across ManoMano’s European markets; the company reported no evidence that its internal systems were altered and stated that **passwords were not accessed**. Reportedly exposed data varies by customer but includes **names, email addresses, phone numbers, and customer service communications** (including support tickets and potentially attachments). A threat actor using the alias **“Indra”** claimed responsibility on a hacker forum and alleged possession of approximately **37.8 million** user records, a figure broadly consistent with ManoMano’s notification, though the claim has not been independently verified. ManoMano said it **blocked the compromised account, revoked the subcontractor’s access**, and implemented **enhanced access controls** while continuing its investigation.
Jun 29, 2026
Palo Alto Networks Unit 42 reported that **TeamPCP** has conducted a multi-stage supply chain campaign aimed at security infrastructure providers, describing a pattern in which the actor compromises organizations that sit inside customer build, deployment, and protection workflows. The activity highlights the risk of attacking trusted security tooling and cloud-connected platforms to gain access to downstream environments, internal architecture, and sensitive operational data. A later dark web listing tied a campaign called **CanisterWorm** to the same actor set, with a seller using the name **xpl0itrs** claiming to offer data allegedly stolen from **RapidFort**, a container hardening and software supply chain security vendor, for **$40,000**. The unverified listing advertised **569GB** of data across **140,061 files** from **48 S3 buckets**, including hardening pipelines, vulnerability database pipelines, scanner backends, DevOps infrastructure, billing exports, plaintext cloud credentials, Kubernetes `kubeconfig` files, and private keys; if authentic, the exposure could create follow-on intrusion opportunities because RapidFort reportedly operates within customer CI/CD environments and may hold cross-account access into customer cloud estates.
Jul 30, 2026