2026 bol.com — ~400k customer records claimed on forums; retailer disputes (Apr)
Data compromised
E-commerce profile and order metadata per actor claims—authenticity contested
Technical writeup
In mid–April 2026, Dutch and European trade press (Security Boulevard, Techzine, SC Media, Cybernews) described a criminal-forum listing offering roughly 400,000 bol.com-oriented customer rows, often framed as Belgian-account heavy, with fields such as names, emails, phones, DOB, addresses, and order metadata. bol.com publicly stated it saw no evidence of a hack and treated the matter as under investigation while security analysts cautioned listings may recycle older leaks. This entry captures the public dispute and investigation narrative.
Root cause
Unverified external compromise vs. recycled/aggregated data (disputed)