Minted Data Breach (2020): What Was Exposed & What To Do

In May 2020, records for 4.4 million customers of the online marketplace Minted were offered for sale on a dark web marketplace. The incident involved email addresses, names, physical addresses, phone numbers and passwords stored as bcrypt hashes. Public reporting of the event began on 6 May 2020, with the data later supplied to Have I Been Pwned by dehashed.com. The exposure placed ordinary customer contact details and login credentials into circulation. Individuals whose information appeared in the records face the possibility that their details could be used in further campaigns without their knowledge.

Breaking down the breach

The incident was reported on 6 May 2020. It affected 4.4 million unique customer records. The exposed fields included email addresses, names, physical addresses, phone numbers and passwords stored as bcrypt hashes. The records were subsequently listed for sale on a dark web marketplace. No further technical details about the intrusion method, the date of the initial compromise or the volume of any additional files have been made public.

How a breach like this happens

Marketplace platforms store large volumes of customer records to support orders, shipping and account management. Attackers frequently obtain access through stolen credentials, unpatched software or misconfigured databases. Once inside, they can copy tables containing contact information and hashed passwords. The data may then be packaged and offered for sale on underground forums, where buyers seek ready-made lists for phishing or account-testing activity. In many cases the initial access vector remains undisclosed after the breach becomes public.

About Minted

Minted operates an online marketplace that connects independent artists with customers purchasing art, stationery and related goods. Like other e-commerce sites, it collects names, shipping addresses, telephone numbers and email addresses to complete transactions and manage accounts. Passwords are stored to allow returning customers to log in. A breach at such a service is consequential because the records combine verifiable personal identifiers with credentials that may still be reused on other sites.

What was likely exposed

The reported records contained the following categories of information:

• Email addresses
• Names
• Physical addresses
• Phone numbers
• Passwords stored as bcrypt hashes

Exact confirmation of every field present in the full dataset has not been released beyond these categories.

Why it matters

Contact details combined with passwords increase the chance that affected individuals will receive targeted phishing messages or attempts to access other accounts where the same password was used. Physical addresses and phone numbers add to the pool of information that can support identity-related fraud. For the organisation, the incident highlights the long-term value attackers place on customer datasets from retail platforms, even when passwords are hashed.

If your data was in this breach

Begin by changing the password on any Minted account and on any other service where the same password may have been used. Enable multi-factor authentication where available. Monitor email and postal mail for unexpected messages that reference the details listed above. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in public records of this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.