2026 Generation Tux — ~2.8M customer records sale claim via auth-bypass SQLi (unverified)
Data compromised
Actor claim (unverified): ~2.8M unique customers — names, emails, phones, password hashes (~2.887M), Facebook IDs, ZIP/state/street/city/country; ~1.53M with addresses; asking price $2,000
Technical writeup
Unverified forum sale — Dark Web Informer September 16, 2026. Actor seraphims offered alleged Generation Tux (U.S. tuxedo/suit rental) customer data: ~2.8 million unique records with names, emails, phones, password hashes, Facebook IDs, and address fields, claiming August 2026 auth-bypass SQLi. Company confirmation not located at catalog time. recordsAffected 2800000 (unverified); companyConfirmed false.
Root cause
Unverified forum sale (actor seraphims) claiming August 2026 authentication-bypass SQL injection