Shopee Customer Database Allegedly for Sale, 300 Million Records Claimed Across Asia and Latin America
A seller posting as 666op is advertising what they describe as a customer database from Shopee, the e-commerce marketplace operated by Sea Limited. The listing claims more than 300 million unique records dated to March 2026, and states the affected population spans Indonesia, Taiwan, Thailand, Singapore, and parts of Latin America. Advertised fields include full names, email addresses, phone numbers, addresses, city and country, last order date, order counts, total spend, currency, and device identifiers. A 150-record sample is linked from the post. The asking price is $1,200. The claim is unverified, and the record count is substantially higher than most listings of this kind.
▣Post details
!Allegedly included
- Full names
- Email addresses
- Phone numbers
- Addresses
- City
- Country
- Last order date
- Order counts
- Total spend
- Currency
- Device identifiers
◱Screenshot
⚠Potential impact
The claimed scale warrants scepticism before it warrants alarm, and the two should be held together rather than traded off. If the set is authentic at anything near the stated volume, the exposure is broad but shallow: no passwords, payment details, or government identifiers are advertised, which caps the direct fraud risk considerably. What the fields do support is high-quality targeted phishing at enormous scale. Name, phone, address, last order date, and total spend together let a message reference a real recent purchase and a real account history, which is the difference between a scam that most people spot and one that most people do not. In several of the named markets, mobile-first commerce and delivery-notification messaging are the norm, so a fraudulent order or delivery message lands in an expected channel. Total spend and order counts also segment the population by value, allowing a buyer to isolate the highest-spending customers rather than working the list indiscriminately. The device identifiers are the field with the longest tail, since they persist across sessions and support correlation against other breached datasets in a way that names and emails alone do not. The low asking price relative to the claimed volume is worth noting: at $1,200 for 300 million records, the pricing is inconsistent with a genuinely exclusive dataset and would be more typical of aggregated, recycled, or partially fabricated material. The claim is unverified.
iStatus
UnverifiedSeveral features of this listing invite caution. The price is very low for the volume claimed, the seller account has almost no posting history despite holding a purchased forum rank, and the advertised schema contains no platform-specific fields of the kind an internal Shopee export would ordinarily carry, consisting instead of generic commerce attributes that could be assembled from multiple sources. Aggregated datasets are frequently marketed as single-company breaches, and a 150-record sample cannot establish the provenance of 300 million. Dark Web Informer is not reproducing the sample location or the seller's contact identifier. None of this establishes that the data is fabricated, and the possibility of a genuine large-scale exposure cannot be dismissed on pricing alone. The claim is unverified and Shopee has not publicly addressed it. Customers in the named markets may wish to treat order and delivery notifications with additional care, particularly those arriving by SMS or messaging apps.
DARK WEB INFORMER - THREAT INTELLIGENCE
