Blooms Today Data Breach (2023): What Was Exposed & What To Do

Online retailers that handle everyday purchases have become steady targets in a threat landscape where customer databases are routinely stolen, packaged, and offered for sale on criminal forums. The Blooms Today incident fits that pattern: a large volume of customer records tied to an online florist appeared for sale months after the newest data in the set was collected, leaving millions of people to weigh the practical risks of exposed contact and payment-related details.

Public reporting places the exposure at roughly 3.2 million unique email addresses alongside names, phone numbers, physical addresses, and partial credit card data. The listing itself surfaced in April 2024; the organisation did not respond when asked about the incident. Exact intrusion methods and full internal timelines remain undisclosed.

Inside the incident

According to the available record, 15 million records attributed to Blooms Today were listed for sale on a popular hacking forum in April 2024. The most recent data in that corpus dated to November 2023. Within the material were approximately 3.2 million unique email addresses, together with names, phone numbers, physical addresses, and partial credit card information consisting of card type, the last four digits of the number, and the expiry date.

The same reporting states that the exposed card fields were not sufficient to complete purchases. The incident was reported on 11 November 2023. Blooms Today did not respond when contacted about the matter. No further public detail has confirmed how the data left the company’s systems, whether a single intrusion or a longer-term compromise was involved, or whether any notification was issued directly to affected customers.

How a breach like this happens

Incidents that end with customer databases appearing on criminal forums typically follow a small number of well-worn paths. Attackers often obtain initial access through stolen or guessed employee credentials, unpatched software on internet-facing systems, or malicious documents and links that install remote-access tools. Once inside, they map the network, locate databases or backup files that hold customer records, and copy the data quietly over days or weeks.

The stolen files are then cleaned, deduplicated, and advertised. Buyers may use the material for phishing, account takeover attempts on other services, or identity-related fraud. Because no specific threat group has been attributed in the public facts for this case, it is not possible to say which of these routes was used against Blooms Today; the pattern above simply describes how breaches of this general type commonly unfold.

Blooms Today and its sector

Blooms Today operates as an online florist, taking orders for flowers and related gifts and arranging delivery. Businesses in this sector routinely collect the information needed to process payments, confirm orders, and ship products to homes and offices. That typically includes customer names, email addresses, telephone numbers, delivery addresses, and payment-card details handled through checkout systems.

A breach at such a retailer is consequential because the data combines lasting identifiers (names, emails, physical addresses) with enough payment context to make targeted social-engineering attempts more convincing. Customers who ordered gifts or recurring deliveries may not immediately connect a later phishing message or unexpected call to a florist they used months earlier, which increases the chance that fraudulent contact succeeds.

What data was at risk

The facts name the following categories as present in the exposed material: email addresses, names, phone numbers, physical addresses, and partial credit card data (card type, four digits of the number, and expiry date). Reporting explicitly notes that the card data was incomplete and insufficient to make purchases.

No additional data types have been confirmed in the public record. Organisations of this kind commonly also hold order histories, delivery instructions, and full payment tokens inside their payment processors; whether any of those elements were included here remains unconfirmed. Readers should treat only the named categories as established.

Why it matters

For individuals, the combination of name, email, phone number and home address supports convincing phishing and smishing campaigns. An attacker can reference a plausible past flower order or delivery address to build trust before asking for passwords, one-time codes, or further payment details. Partial card data alone cannot be used to charge a card, yet it can lend authenticity to fake “verify your card” messages. Reused passwords on the email address become a separate risk if the same credentials protect other accounts.

For the organisation, the episode creates lasting customer distrust, potential regulatory scrutiny, and the operational cost of investigation and remediation—costs that are harder to manage when the company has not publicly addressed the listing. Because the data appeared for sale well after the newest records were dated, affected people may already have been targeted without realising the source.

What to do if you're exposed

If you have shopped with Blooms Today or believe your details may be involved, start with basic hygiene. Change the password on the email address associated with any orders, and enable multi-factor authentication wherever it is offered. Treat unsolicited messages that mention flower deliveries, refunds, or card verification with scepticism; do not click links or share codes. Monitor bank and card statements for unfamiliar activity and consider a fraud alert with major credit bureaus if you see signs of misuse. Review account recovery options on important services so that a compromised email or phone number cannot be used to reset them.

You can also run a free exposure scan of your email address to check whether it has appeared in known breach data sets. That check does not undo the incident, but it gives a clearer picture of whether your address is already circulating and helps prioritise which accounts to secure first.

AICompiled with AI assistance from public sources and published under our editorial standards.