PetFlow Data Breach (2017): What Was Exposed & What To Do

In December 2017, the pet care delivery service PetFlow suffered a data breach that exposed records from nearly one million accounts. The affected data later appeared for sale on a dark web marketplace, with the exposed fields limited to email addresses and passwords stored as unsalted MD5 hashes. The incident was reported on 9 December 2017. No further technical details on the intrusion method, exact date of access, or subsequent actions by the organisation have been made public.

Breaking down the breach

Public records state that the breach involved 991,000 accounts. The only data types confirmed as exposed are email addresses and passwords held in unsalted MD5 format. The dataset was offered for sale on a dark web marketplace, which is how the incident became known.

Timing of the initial compromise, the means of entry, and any internal detection or response steps remain undisclosed. No additional data fields have been confirmed in reporting on this event.

How a breach like this happens

Incidents involving customer account data from online retailers commonly begin with unauthorised access to a company’s systems, whether through compromised credentials, unpatched software, or misconfigured services. Once inside, an attacker can copy stored records and later attempt to monetise them by listing the material on underground forums.

Password data stored as unsalted MD5 hashes can be processed offline by anyone who obtains the file. The absence of salting reduces the computational effort required to test large numbers of possible passwords against the hashes.

PetFlow and its sector

PetFlow operated as an online retailer delivering pet supplies directly to customers. Companies in this sector maintain customer accounts that include contact details and login credentials to support repeat orders and payment processing.

A breach at such a service can affect individuals who used the same email and password combination on other sites. Because the passwords were stored without salting, any weak or reused credentials become easier to identify once the file circulates.

The information in question

The breach record identifies two categories of data: email addresses and passwords stored as unsalted MD5 hashes. No other data types are listed in the available reporting.

Organisations of this type routinely hold additional details such as names, delivery addresses, and payment information, yet the precise contents of the PetFlow dataset beyond the two confirmed fields have not been publicly verified.

The real-world impact

Individuals whose email addresses and password hashes were exposed face an increased chance that their credentials will be tested against other online services. Re-use of the same password across sites amplifies this risk.

For the organisation, the incident created a public record of exposed customer data and required notification or remediation steps typical after such disclosures. The long-term effects depend on how many affected users changed passwords and whether the data was further distributed.

If your data was in this breach

Change the password on the PetFlow account and on any other service where the same password was used. Enable multi-factor authentication where available, and monitor email accounts for unexpected login attempts.

Readers can run a free exposure scan of their email address against known breach data to determine whether their information appears in this or other documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.