ManoMano: Support-Portal Breach Exposes Millions of Customer Records
Context and chronology
ManoMano has disclosed a substantial data exposure centered on its customer‑support channel, with notices this week referencing an intrusion traced to January. Forensics and public postings point to a compromised third‑party support supplier rather than a direct failure of ManoMano’s storefront. An actor using the alias 'Indra' has posted artifacts and claims: roughly 37.8 million accounts and an estimated 43 GB of exported support records, including contact fields, support transcripts and attachments. Affected customer sets span ManoMano’s five European markets, producing immediate cross‑border notification and enforcement considerations.
Technical vector, corroborating tradecraft and scope
Available indicators point to access through a ticketing/help‑desk environment used by ManoMano’s support supplier; industry signals identify that mainstream cloud ticketing platforms are commonly present in such workflows. Comparable incidents tracked elsewhere add crucial context: some adversaries combine help‑desk compromise with endpoint infostealers and credential caches, while others pair social‑engineering (vishing) and real‑time session orchestration to defeat one‑time codes and MFA. That combined tradecraft increases the likelihood that exposed support transcripts and contact records will be weaponized for highly convincing targeted attacks and for credential‑stuffing campaigns using bulk credential caches discovered in underground repositories. Reported counts in the posted archive are large (>900,000 service tickets; >13,000 attachments) but remain subject to independent forensic verification; past incidents show actor‑claimed volumes can include aggregated, duplicated, or partially overlapping datasets.
Operational and detection lessons
Other recent breaches illustrate two contrasting operational realities: rapid service restoration is possible (as seen in unrelated IT‑distribution incidents) even while substantial exfiltration occurred prior to containment. That pattern implies detection and segmentation gaps in environments that permit data copying before isolation. For organizations relying on federated SSO and help‑desk workflows, defenders should treat session governance, telephony‑fraud signals, and endpoint telemetry as first‑order detection controls—not optional add‑ons. The combination of exposed contact data and external credential caches materially increases the probability of successful targeted vishing, MFA‑orchestration, and account‑takeover efforts.
Regulatory, market and customer impact
Expect accelerated EU data‑protection scrutiny and potential cross‑border coordination among authorities, given the multi‑market exposure. Downstream effects include increased fraud, higher remediation and notification costs, potential remediation demands from partners and payment vendors, and tighter vendor‑risk clauses. Insurance carriers will revisit incident scope during claims triage, which can influence future premiums for ecommerce firms using outsourced support services.
Tactical recommendations
Treat this as a supplier compromise that requires immediate, multi‑vector containment: revoke supplier access, rotate service credentials, isolate and snapshot affected support environments, and prioritize targeted password resets for high‑risk accounts. Revoke active sessions and consider forced re‑authentication for users with sensitive activity. Enforce least‑privilege on ticketing workflows, require stronger SLAs and audit rights with vendors, and accelerate adoption of phishing‑resistant authentication (hardware tokens or platform‑bound cryptographic MFA). Expand monitoring for telephony fraud, investigate potential use of credential caches in underground markets, and offer clear notifications and remediation options to affected customers. For long‑term resilience, mandate segmentation of support tooling from core customer data stores, deploy DLP around ticketing exports, and require contractual security attestations for subcontractors.
Read Our Expert Analysis
Create an account or login for free to unlock our expert analysis and key takeaways for this development.
By continuing, you agree to receive marketing communications and our weekly newsletter. You can opt-out at any time.
Recommended for you
Canadian Tire: Data Compromise Hits Tens of Millions of Customers
A wide-scale e-commerce breach at Canadian Tire exposed roughly 38M customer accounts and an auxiliary data set that totals about 42M records. Passwords hashed with PBKDF2 , partial payment details, and contact fields are in circulation, raising fraud and regulatory risk. Industry signals from other recent retail and support-channel incidents indicate attackers often combine credential caches, infostealers and social‑engineering to amplify impact.
Ransomware strike at Ingram Micro exposes sensitive records of ~42,500 people
A July ransomware incident at Ingram Micro led to the theft of employment and applicant records for about 42,521 people and service outages that were largely resolved within a week. A threat actor later published roughly 3.5 TB of claimed data; the company is offering two years of identity protection while facing regulatory notification, legal exposure, and heightened supply‑chain scrutiny.
U.S. Panera Bread Customer Data Dumped After ShinyHunters Exploit Microsoft Entra SSO
ShinyHunters published a large archive of customer contact data it says was taken from Panera Bread after a failed extortion attempt, claiming about 5.1 million unique email addresses within an asserted 14 million-record haul. Researchers say the Panera intrusion matches a wider, telephone-based social-engineering trend—real-time vishing paired with browser phishing toolkits—and a separate unsecured infostealer cache of roughly 149 million credentials that together amplify risks of credential stuffing and targeted account takeover.
DHS Data Breach Exposes ICE Contracts and Multi‑Million Awards
A hacktivist collective released procurement records tied to DHS and ICE, revealing contracts with thousands of vendors and multi‑million dollar awards. Related reporting and security research suggests the disclosures extend beyond vendor files to lease lists, embedded GSA activity and exposed admin credentials, increasing operational and legal disruption risks.
LexisNexis breach exposes legacy datasets, raises cloud-hygiene alarm
LexisNexis confirmed an intrusion that exposed legacy files and identifiers, with the attacker alleging exploitation of React2Shell and weak cloud controls. Immediate risks include exposed credentials, roughly 400,000 personal records, and elevated regulatory and insurance scrutiny — a pattern echoed by recent large-scale exfiltrations where fast operational recovery did not eliminate downstream fraud and identity risk.
Sears Home Services Left Millions of Voice and Chat Records Public
Security researcher Jeremiah Fowler found publicly accessible databases holding millions of Sears Home Services chatbot chats and audio files, including multi-hour ambient recordings that exposed personal details. The exposure fits a broader pattern—other consumer-facing conversational systems (including connected toys) have leaked transcripts due to weak defaults—though remediation speed and external validation have varied across incidents, affecting regulatory and reputational fallout.
ApolloMD Data Breach Exposes PHI for Over 626,000 Individuals
A late‑May 2025 intrusion into ApolloMD’s systems led to the unauthorized access and copying of personally identifiable and clinical information for about 626,540 people, with some files containing Social Security numbers; the incident was later posted to a ransomware-linked leak site. ApolloMD reported the event to federal health authorities, began mailing breach notifications by September 2025 and is offering affected parties complimentary credit monitoring, highlighting broader third‑party risk in health data aggregation.
Bitrefill Breach Tied to Lazarus Drains Wallets, Exposes 18,500 Orders
Crypto retailer Bitrefill disclosed a March intrusion that read ~ 18,500 purchase records and drained parts of hot wallets, with investigators linking traces and reused toolsets to the DPRK-linked Lazarus collective. Analysts note the tactics mirror recent supply‑chain and control‑plane operations—credential theft, ephemeral loaders and CDN/DNS abuse—meaning attribution may be strong on technique but not uniquely definitive.