Online Trade (Онлайн Трейд) Data Breach (2022)

On September 19, 2022, Russian e-commerce site Online Trade (Онлайн Трейд) appeared in a major breach database after 3.8 million customer records were exposed. The incident, which occurred earlier that year, revealed names, email addresses, phone numbers, dates of birth, IP addresses, and MD5 password hashes belonging to its customers.

Reported Details from the Breach

The primary disclosure on Have I Been Pwned states that the breach took place in 2022 and made available a database containing 3.8M affected users. Exposed information included dates of birth, email addresses, IP addresses, names, passwords stored as MD5 hashes, and phone numbers. The listing does not specify how the attackers initially gained access or whether the data was sold on underground forums before being indexed. No ransom demand or extortion timeline is detailed in the public record.

Why This Matters for You and Your Family

If you shopped on Online Trade, your personal details are now loose on the internet. Names, phone numbers, dates of birth, and email addresses combined can be used to impersonate you, reset accounts at other services, or target your family with phishing texts and calls. MD5 hashes, while not plaintext, can often be cracked with modest computing power, especially if you reused the same password elsewhere. IP addresses add location context that helps attackers build a more complete picture of your household. Children or other family members who share an email or phone on the account face the same risks.

Doxxing and Identity-Chain Risks

Once names, phones, and emails leak, attackers chain them with data from other breaches to map your full digital footprint. A cracked password can lead to takeover of your email, which then exposes shopping history, linked bank cards, or even children’s gaming accounts that use the same credentials. This creates persistent doxxing chains where one breach fuels the next. Public records tied to your name and date of birth can be cross-referenced with the leaked phone number to locate your physical address. The exposure therefore extends far beyond a single shopping account.