2026 Shopee — forum sale claim (~300M records, Asia + LatAm; unverified)
Data compromised
Advertised fields: full names, email addresses, phone numbers, addresses, city/country, last order date, order counts, total spend, currency, device identifiers — no passwords, payment details, or government IDs claimed. Unverified; scale and provenance questioned by DWI analysis.
Technical writeup
Unverified forum sale listing — observed July 28, 2026 on Dark Web Informer. A seller posting as "666op" advertised what they described as a Shopee customer database containing more than 300 million unique records dated to March 2026, spanning Indonesia, Taiwan, Thailand, Singapore, and parts of Latin America. Advertised fields include full names, email addresses, phone numbers, addresses, city/country, last order date, order counts, total spend, currency, and device identifiers — no passwords, payment details, or government identifiers. Asking price was $1,200. DWI analysis noted multiple skepticism factors: very low price relative to claimed volume, thin seller history, no platform-specific fields, and 150-record sample cannot establish provenance of 300M. Possible aggregation from multiple sources. Shopee (Sea Limited) had not publicly addressed the claim at indexing time. BreachHistory indexes the actor-cited 300M count clearly labeled unverified.
Root cause
Unverified dark-web forum listing by seller "666op" claiming ~300 million Shopee customer records dated Mar 2026 — Shopee had not publicly addressed the claim at indexing