A dataset advertised on a criminal forum in October 2024 was described as covering around 57 million Hot Topic customers, with reported fields including email addresses, telephone numbers and partial payment card details.
Partial Card Details Still Work
The last four digits of a card are treated as non-sensitive because they cannot be used to transact. They are also what a call-centre agent asks for to confirm identity.
A caller who can produce a name, an email address, a telephone number and the last four digits will pass most verification scripts. Fields are classified by what they enable directly and used for what they enable in combination.
Fifty-Seven Million From A Clothing Retailer
The figure is larger than the customer base most people would assume for a specialist retailer, which is usually a sign of loyalty scheme records accumulated over many years rather than active shoppers.
Graded medium: the count and field list come from the seller and the company has not published a figure of its own.
Compiled from public reporting of the forum listing, listed below. The 57 million figure and field list originate with the seller and are not corroborated by the company. Corrections: corrections@forensicpost.com.
- Hot Topic data breach exposes info of 57 million customersBleepingComputer