HauteLook Data Breach (2018): What Was Exposed & What To Do

HauteLook, an online fashion retailer, was affected by a data breach first reported on 7 August 2018. The incident involved records for 28.5 million individuals, including email addresses, names, genders, dates of birth, geographic locations and passwords stored as bcrypt hashes. The data later appeared for sale in early 2019 and was contributed to Have I Been Pwned by dehashed.com.

What happened

The breach occurred sometime in mid-2018. Public records indicate that the data set, containing more than 28 million unique email addresses together with names, genders, dates of birth and bcrypt-hashed passwords, was offered for sale in early 2019. No further technical details about the intrusion method or the precise date of access have been disclosed.

How a breach like this happens

Incidents involving large customer databases at online retailers often begin with the compromise of a web application, server, or third-party service that stores user records. Attackers may exploit unpatched software, weak authentication controls or stolen credentials to reach the database. Once inside, they can copy tables containing personal information and credentials before the activity is detected. The stolen data may then be packaged and sold on underground forums months later.

HauteLook and its sector

HauteLook operates as a flash-sale platform in the fashion retail sector, where customers create accounts to view and purchase clothing and accessories. Companies of this type routinely collect names, contact details, demographic information and passwords to manage accounts, process orders and personalise offers. A breach at such a service is consequential because the data can be used for targeted phishing or attempts to access other accounts where users have reused passwords.

What was likely exposed

The available information lists the following categories of data as present in the data set:

• Dates of birth
• Email addresses
• Genders
• Geographic locations
• Names
• Passwords stored as bcrypt hashes

Exact confirmation of every field for every record remains limited to the details released by the source that supplied the data to breach-tracking services.

The real-world impact

Individuals whose records were included may face increased risk of phishing emails that reference personal details such as name or date of birth to appear credible. Bcrypt-hashed passwords are computationally resistant to rapid cracking, yet any account that reused the same password elsewhere could still be targeted. For the organisation, the incident adds to the record of known exposures in the retail sector and may prompt reviews of data retention and access controls.

Were you affected?

Check whether your email address appears in known breach data by using a free exposure scanning service. If your information is listed, change the password on the affected account and on any other service where the same password was used. Enable multi-factor authentication where available and monitor incoming email for unusual activity that references personal details from the data set.

AICompiled with AI assistance from public sources and published under our editorial standards.