underground-data-leakmass-credential-exposurebreach-disclosure-notificationidentity-impersonation-fraud

Threat Actor Claims Theft of 400,000 Bol Customer Records

Breach & Incident Intelligence · 2 sources · Updated 5mo ago · First seen Apr 20, 2026

A threat actor using the alias "Jeffrey Epstein" claimed to have stolen data on more than 400,000 Belgian customers of Dutch online retailer Bol and advertised the dataset for sale on a dark web forum. Reports said the actor published a sample to support the claim and directed prospective buyers to negotiate through Telegram or Session.

The allegedly exposed records include names, birthdates, phone numbers, email addresses, physical and shipping addresses, tracking numbers, order history, and some payment-related details, though reports said passwords and bank or financial data were not included. Bol said it was taking the claim seriously but had no evidence of a hack or attack, that its systems were operating normally, and that no ransomware was involved; if the data is genuine, it could be used in phishing, identity theft, and fraud targeting affected customers.

Is this vendor in your chain?See attribution, scope, and your downstream exposure.

Check the blast radius

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Apr 20, 2026

Apr 20, 20267mo ago
Bol denies breach and says no evidence of attack exists
Bol responded that it was taking the report seriously but had found no evidence of a hack or attack, said its systems were operating normally, and stated that no ransomware was involved. This denial accompanied public reporting on the alleged data theft.
Apr 20, 20267mo ago
Threat actor claims theft of 400,000+ Bol customer records
A threat actor using the alias "Jeffrey Epstein" claimed on a dark web forum to have stolen personal and transactional data belonging to more than 400,000 Belgian customers of Dutch retailer Bol. The actor allegedly posted a sample of the data and offered the dataset for sale via Telegram or Session.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Organizations

1 linked

bol

Breaches

1 linked

BOL-2026-04

Do you run this?See attribution, scope, and whether this vendor sits anywhere in your supply chain.

Get the Full Incident Picture

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

ScworldNews · Apr 21, 2026

Over 400K records allegedly stolen from major Dutch webshop Bol, data leaked | brief | SC MediaOpen source ↗

CybernewsNews · Apr 20, 2026

Hacker Jeffrey Epstein claims 400K records stolen from Bol | CybernewsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Threat Actor Claims Theft of 400,000 Bol Customer Records

How this story unfolded

Bol denies breach and says no evidence of attack exists