Locally Data Breach (2022)

On October 1, 2022, the online-to-offline shopping platform Locally was listed in a public breach database after suffering an intrusion that exposed records belonging to 363,000 people. The company, which describes itself as “The Industry’s Leading Online-to-Offline Shopping Solution,” privately acknowledged the breach but it remains unclear whether every affected customer received direct notification. The exposed information includes names, email addresses, phone numbers, physical addresses, purchase histories, partial credit card details, and bcrypt-hashed passwords.

What's Publicly Reported from the Disclosure

The primary record in Have I Been Pwned states that the Locally breach occurred in 2022 and contains 363K records. Data types listed are email addresses, partial credit card data (type and last four digits), passwords stored as bcrypt hashes, phone numbers, physical addresses, and purchases. The disclosure does not specify the exact attack vector, whether data was encrypted at rest, or the precise date the intruder first gained access. It also does not confirm whether Locally paid any ransom or engaged with the threat actor. Public details stop at the dataset appearing in breach repositories after the company’s private admission.

Why This Matters for You and Your Family

When a shopping platform that links online orders to in-store pickup or local delivery is breached, the exposure goes far beyond a simple email list. Physical addresses, phone numbers, and purchase histories create a detailed profile of where you live, what you buy, and when you are likely to be away from home. Partial credit card data combined with names and addresses can be used to craft convincing phishing calls or to attempt card-not-present fraud. Because many families reuse the same password across shopping, banking, and email accounts, a single bcrypt hash that is eventually cracked can open multiple doors. Children’s accounts tied to a family email are also at risk if the parent’s credentials are reused for school portals or gaming services.

The Doxxing and Identity-Chain Implications

Addresses and phone numbers turn a username into a real-world target. Threat actors can cross-reference the Locally data with other leaks to map your full household, link social-media handles, and locate family members. Purchase histories reveal interests, income brackets, and daily routines, information that fuels highly targeted social-engineering attacks or physical stalking. Credential exposure from shopping sites frequently cascades into gaming account takeovers; a cracked password used for a child’s Roblox or Fortnite account can lead to further doxxing once chat logs and linked emails are harvested. These chains grow quickly because one breach supplies the seed data that unlocks others.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate the password you used on Locally anywhere it is reused and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists manage takedown requests for any newly surfaced personal records on data-broker and extortion sites.

The Locally breach is a reminder that even medium-severity retail incidents can hand attackers the exact material needed to build persistent identity chains. Staying ahead requires more than changing one password; it demands ongoing visibility and expert assistance. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly includes children’s gaming accounts. Start your DoxxScan trial today to close the gaps this breach and future ones can exploit.