-
A hacker claims to have leaked records of about 263,000 people who shopped on the French discount site Aloyoga Soldes.
-
The records allegedly hold names, emails, birth dates, phone numbers, shipping details, and passwords protected with MD5.
-
No one has confirmed the claim yet, so the 263,000 figure is only the hacker’s own estimate.
A hacker says they have leaked a customer database from a French online store. The store, called Aloyoga Soldes, sold goods at discount prices. Reports say it no longer operates.
The claim first appeared on social media. The account Dark Web Intelligence shared it. The account monitors cybercrime activity and underground forums.
Hacker Says Closed Store Left Its Database Exposed
According to the post on X, the database holds first and last names. It also lists email addresses, gender, birth dates and phone numbers. Shipping details appear too, including cities, postcodes and countries. The records reportedly include passwords as well. The store allegedly protected them with the MD5 hashing method.
The hacker reportedly says the store closed but left an SQL database file exposed on its server. An SQL file is a database file. It can hold many records in one place. The post gives no more detail than that. It does not explain how the hacker got the database. It does not say when the exposure happened. It also does not show whether the records belong to real customers.
The claim has no independent confirmation. The website’s operators have made no statement. No technical review has backed up the leak either. So the figure of 263,000 is the hacker’s own estimate. It is not a confirmed count of affected people.
The store’s closure raises another question. Who controls its systems and customer records today? The available information does not say whether the database is still reachable. It also does not say whether anyone has used the data for fraud.
Personal Details and Weak Password Protection Raise Fraud Worries
If the database is real, former customers could face several risks. Criminals could use names, email addresses, phone numbers and birth dates. They could write convincing phishing messages. They could also pretend to be the customers themselves. Messages built on real details are harder to spot.
Shipping details could help scammers too. Attackers could send fake delivery notices that include a person’s name and location. Such a message looks more believable than a generic scam. It may claim a parcel needs extra payment. It may also say an account needs checking.
The MD5 passwords add another worry. MD5 is an outdated hashing method. It is a poor choice for storing passwords. The Open Worldwide Application Security Project (OWASP) recommends stronger options. These include Argon2id, scrypt and bcrypt. OWASP says these methods are built for storing passwords. Each one makes password guessing harder.
A hashed password is not the same as a plain password. Its exposure does not mean every password can be recovered. Still, MD5 works very fast. That speed lets attackers test huge numbers of guesses. The task gets easier when customers pick common or predictable passwords.
The leak, if real, mixes contact, location and password data in one place. That mix gives criminals many ways to target one person. Reused passwords bring extra danger. Suppose attackers recover one. They may try it on email accounts, shopping platforms and other online services. A single leaked password could then open several doors.
A similar concern arose in Denmark, where the University of Copenhagen confirmed a second cyberattack following a data breach that affected 525,000 people.
Proof Is Still Missing for the Alleged Aloyoga Soldes Leak
Searches for independent reports found no reliable cybersecurity publication that had verified the incident. Right now, the claim rests on one source, the hacker. This does not prove the claim is false. It only means public evidence is too thin to call this an established breach.
This case also differs from any breach involving Alo Yoga, the international activewear brand. The available information does not link the two. Nothing shows that the discount site and the brand share owners, systems or customer databases.
Former customers who recognize the website can take a few simple steps. First, change any password you reused on other sites. A fresh password for each site limits the damage if one leaks. Next, turn on multifactor authentication for your important accounts.
It adds a second check before anyone can log in. Stay alert to unexpected messages that ask for payments or login details. Visit services through their official websites rather than links in unsolicited messages.
French users can also read guidance from the data protection body CNIL. It publishes a page on how to notify a personal data breach. It also explains the rules to follow after a data breach.
Until more evidence appears, readers should treat the 263,000 figure as a hacker’s allegation. It is not a confirmed data breach. Three things would help settle the matter. An independent check of the database would show whether the records are genuine.
Confirmation from the website’s operators would explain who holds the data now. A statement from a relevant authority would add more proof. Together, these steps would show whether the claim is real and how large it is.
