HomeRefill Data Breach (2020): What Was Exposed & What To Do

In April 2020, the Brazilian e-commerce platform HomeRefill suffered a data breach that exposed records belonging to 187,000 individuals. The incident was reported on 2 April 2020, and the data later appeared in a larger collection of records drawn from multiple unrelated breaches. The exposed information included names, email addresses, phone numbers, dates of birth and salted password hashes. HomeRefill has since ceased operations, which limits further public information about the event.

Breaking down the breach

The breach affected 187,000 unique email addresses and the associated personal details listed above. No information has been released on the method of intrusion, the precise date the data were first accessed, or whether the incident was discovered internally or through external notification. The only confirmed public record is the redistribution of the dataset in April 2020 as part of a broader corpus of previously breached material.

How a breach like this happens

Incidents involving customer databases at online retailers commonly result from unauthorised access to web servers or backend systems that store account information. Attackers may exploit unpatched software, weak authentication controls or stolen administrative credentials to reach the data. Once obtained, the records are frequently packaged and circulated among multiple parties, sometimes appearing months or years later in aggregated collections. In the absence of a disclosed timeline or technical description, the exact sequence in this case remains unknown.

Who is HomeRefill?

HomeRefill operated as an e-commerce platform based in Brazil, offering goods directly to consumers through an online storefront. Companies of this type routinely collect names, contact details, dates of birth and login credentials to manage accounts, process orders and comply with local regulations. Because HomeRefill is no longer active, the organisation is no longer available to provide updates or direct support to affected customers.

What was likely exposed

The dataset explicitly contained names, email addresses, phone numbers, dates of birth and salted password hashes for 187,000 accounts. No additional categories of information, such as payment card details or physical addresses, are named in the available records. The precise contents of any individual record cannot be confirmed beyond these fields, and the status of the password hashes (whether they have been cracked) is not publicly documented.

Why it matters

Names, dates of birth and contact details can be used to build detailed profiles for targeted phishing or identity-related fraud. Salted password hashes increase the difficulty of immediate credential use, yet they still allow attackers to attempt offline cracking against weak or reused passwords. For individuals whose information appears in the dataset, the combination of personal identifiers and login data raises the possibility of account takeover attempts on other services where the same credentials may have been reused.

Were you affected?

Individuals can check whether their email address appears in known breach datasets by using a free exposure scan service that queries public breach repositories. If an address is found, the recommended first steps are to change the password on the affected account and on any other service where the same password was used, and to enable multi-factor authentication where available. Monitoring financial and email accounts for unusual activity provides an additional layer of vigilance while the long-term risk from the exposed data persists.

AICompiled with AI assistance from public sources and published under our editorial standards.