Alleged Sale of Data from a Shopify Store in Canada

🏢 About the Incident

A threat actor has claimed responsibility for selling a large dataset allegedly originating from a Canadian Shopify store. While the victim organization remains unnamed, the actor advertises access to 73,000 records containing sensitive personal and CRM data.

The compromised dataset is alleged to include customer names, email addresses, phone numbers, mailing addresses, and associated CRM details, posing risks of identity theft, fraud, and exploitation.

⚠ Disclaimer

This report includes actual screenshots and/or text that may include unredacted personally identifiable information (PII) gathered from publicly available sources.
The sensitive information presented within this report is intended solely for cybersecurity awareness and threat intelligence purposes.

📌 Overview

On September 1, 2025, a threat actor known as 0kb posted on an underground forum offering data from a Canadian Shopify store.

The actor claims the dataset includes:

• 73,000 total rows of customer information
• Contact details including emails, phone numbers, and physical addresses
• CRM and marketing information
• Store access and mailing CRM availability (allegedly still active)