Woflow Data Breach (2026): What Was Exposed & What To Do

People whose contact information was held by Woflow now face the possibility that their details have been placed online. The incident, reported on 4 March 2026, involves an AI-driven merchant data platform and affects 448,000 individuals. The exposure centers on names, email addresses, phone numbers and physical addresses tied to the company’s customers and, through them, the customers of merchants that use the platform.

Inside the incident

In March 2026 the ShinyHunters data extortion group listed Woflow as a victim and published tens of thousands of files said to total more than 2 TB. The material reportedly contained hundreds of thousands of email addresses, names, phone numbers and physical addresses. Public reporting gives no further detail on how the data were obtained or on the timeline of the intrusion itself.

The group behind it: shinyhunters

ShinyHunters is a known data-extortion actor that has repeatedly claimed responsibility for large-scale thefts from technology and service companies. Its usual pattern involves obtaining internal data and then posting samples or full archives on leak sites to pressure victims. In this case the group claims the Woflow material originated from the company; that assertion remains unverified by independent confirmation in the available record.

Who is Woflow?

Woflow operates as an AI-driven platform that aggregates and processes merchant data. Companies in this sector routinely collect information from the businesses they serve and, in many cases, from the end customers of those businesses. A breach at such a firm therefore touches both direct account holders and a wider set of individuals whose details pass through the platform in the ordinary course of commerce.

The information in question

The published material is described as including email addresses, names, phone numbers and physical addresses. No other categories of data are named in the reporting. While organisations of this type commonly hold additional fields such as transaction histories or merchant identifiers, the precise contents of the 2 TB archive have not been independently catalogued.

The real-world impact

Exposure of names together with email addresses, telephone numbers and postal addresses can facilitate targeted phishing, unwanted marketing and, in some jurisdictions, doxxing. Because the records also relate to customers of Woflow’s merchant clients, the reach of the incident extends beyond the company’s own direct users. At present there is no public indication that financial credentials or government identifiers were included.

What to do if you're exposed

Individuals can monitor their email accounts for unusual login attempts and consider enabling multi-factor authentication on services that hold similar contact details. Reviewing privacy settings on merchant accounts and watching for unsolicited messages that reference the exposed information are prudent steps. Readers may also run a free exposure scan of their email address against known breach data sets to determine whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.