Online retailer PcComponentes says data breach claims are fake
Recorded: Jan. 21, 2026, 11:03 p.m.
| Original | Summarized |
Online retailer PcComponentes says data breach claims are fake News Featured Credential-stealing Chrome extensions target enterprise HR platforms Microsoft releases OOB Windows updates to fix shutdown, Cloud PC bugs Jordanian pleads guilty to selling access to 50 corporate networks Ingram Micro says ransomware attack affected 42,000 people Chainlit AI framework bugs let hackers breach cloud environments Cisco fixes Unified Communications RCE zero day exploited in attacks New Android malware uses AI to click on hidden browser ads Online retailer PcComponentes says data breach claims are fake Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityOnline retailer PcComponentes says data breach claims are fake Online retailer PcComponentes says data breach claims are fake By Bill Toulas January 21, 2026 PcComponentes, a major technology retailer in Spain, has denied claims of a data breach on its systems impacting 16 million customers, but confirmed it suffered a credential stuffing attack. The leaked data contains order details, physical addresses, full names, phone numbers, IP addresses, product wish-lists, and customer support messages exchanged with the firm via Zendesk. PcComponents data leak on hacker forumsSource: BleepingComputer The 2026 CISO Budget Benchmark Related Articles: Credential Stuffing Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories Microsoft releases OOB Windows updates to fix shutdown, Cloud PC bugs Ingram Micro says ransomware attack affected 42,000 people New PDFSider Windows malware deployed on Fortune 100 firm's network Sponsor Posts Discover how phishing kits are sold and deployed. Download the full research report. Identity Governance & Threat Detection in one: Get a guided tour of our platform Discover how to scale IT infrastructure reliably without adding toil or burnout. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
PcComponentes, a significant Spanish online retailer specializing in computer hardware and peripherals, responded to claims of a data breach affecting 16 million customers with a denial, attributing the incident to a credential stuffing attack rather than a widespread data compromise. The company's investigation, led by its security team, found no evidence of unauthorized access to its databases or internal systems. However, the investigation did reveal a sophisticated attack utilizing stolen credentials obtained from previously breached systems, primarily through information-stealing malware. Specifically, the threat actor, identified as ‘daghetiaw’, targeted the platform with a large volume of compromised email addresses and passwords, common tactics known as credential stuffing. The leaked data, as initially reported by the threat actor, encompassed a substantial amount of customer information, including first and last names, national identification numbers, physical addresses, IP addresses, email addresses, and phone numbers. Crucially, the company confirmed that no financial data or customer passwords were stored on their systems, mitigating a potentially more severe outcome. The incident highlighted a vulnerability related to the reuse of credentials across multiple online services, a persistent issue contributing to numerous data breaches. The attack involved the collection of login data, some as old as 2020, from computers infected with malware. Subsequent to the discovery, PcComponentes implemented immediate defensive measures, including CAPTCHA verification on login pages, mandatory two-factor authentication (2FA) for all accounts, and the immediate invalidation of all active user sessions. This proactive approach was designed to prevent further exploitation of compromised accounts and restrict access for the threat actor. The company strongly recommended that affected customers utilize strong, unique passwords, ideally stored within a password manager, and remain vigilant against phishing attempts. Hudson Rock, a threat intelligence company, played a key role in uncovering the attack by identifying the compromised credentials. Their investigation revealed that the credentials had been sourced from previously breached systems, a consistent pattern in credential stuffing attacks. The company's analysis demonstrated that the attacker had successfully leveraged stolen logins, some dated back to 2020, to gain access to a subset of PcComponentes accounts. This underscored the ongoing risk posed by outdated credentials and the importance of regular password rotation practices. The incident serves as a cautionary tale regarding the prevalence of credential stuffing attacks and the vulnerabilities inherent in reuse of credentials across multiple online platforms. PcComponentes' response, while reactive, demonstrates an understanding of the threat and a commitment to bolstering its security posture. The immediate implementation of 2FA, alongside heightened awareness among customers, represents a reasonable step to mitigate further damage. Moving forward, it becomes imperative for PcComponentes, and indeed all online retailers, to focus on continuous monitoring for suspicious activity, proactive vulnerability management, and robust security awareness training for both its employees and its customer base. The incident emphasizes the need for a layered security approach, combining technological defenses with user education, to combat the evolving landscape of cyber threats. |