Pandabuy Data Breach (2024)

On March 31, 2024, 1.3 million unique email addresses belonging to customers of the Chinese-goods shopping platform Pandabuy appeared in a public hacking forum posting. The leak also contained names, phone numbers, physical addresses, IP addresses, and order-related details. Anyone who placed an order on Pandabuy during the period covered by the dataset now faces concrete risks of identity theft, phishing, and doxxing tied directly to their real-world contact information.

Reported Details from the Disclosure

The primary record on Have I Been Pwned states that the breach occurred in March 2024 and exposed 1.3M unique email addresses along with names, phone numbers, physical addresses, IP addresses, and order enquiries. The listing does not specify the exact number of total affected individuals beyond the unique emails, nor does it confirm the precise root cause or whether payment card data was taken. The data was first posted to a popular hacking forum and has since been indexed by breach-notification services. Public reporting attributes the activity to individuals operating under the handles Sanggiero and IntelBroker.

Why This Matters for You and Your Family

If you have ever used Pandabuy to buy goods from Chinese sellers, your home address, phone number, and full name are now available to anyone who downloads the dataset. That combination allows scammers to craft convincing phishing texts or calls that reference recent orders, making them far harder to spot. Children or other household members who share the same shipping address or phone number can be pulled into the same targeting chain. Once an attacker has your physical address and phone, the door is open to SIM-swapping attempts, mail theft, or even in-person intimidation. The breach is medium severity in classification, yet the real-world exposure is immediate because residential addresses and phone numbers do not expire like passwords do.

Doxxing and Identity-Chain Implications

Physical addresses and phone numbers act as anchors that link disparate online handles back to a single household. An attacker who starts with your leaked Pandabuy email can cross-reference it against gaming accounts, social-media profiles, or school records for your children. This is exactly how doxxing chains form: one breach supplies the seed data that unlocks further personal details across dozens of other services. Credential leaks of this nature frequently cascade into account takeovers on Steam, Roblox, Discord, or other platforms where kids use the same email or password. The presence of IP addresses in the dataset further narrows location data, increasing the precision of any follow-on attacks.

Sanggiero and IntelBroker Track Record

Public reporting attributes multiple data sales and extortion campaigns to the aliases Sanggiero and IntelBroker over the past several years. These actors are known for obtaining large customer databases from e-commerce sites, then releasing or selling them on hacking forums when ransom demands go unmet. Their typical playbook involves initial access through compromised credentials or third-party supplier accounts, followed by bulk exfiltration of customer tables. They favor volume over sophistication, posting samples quickly to demonstrate possession and then auctioning or freely distributing the remainder. While exact prior victim counts vary by report, the pattern is consistent: retail and logistics platforms that handle international shipping data are frequent targets.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate the password used at Pandabuy anywhere it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children's gaming accounts that often chain back to the same address and phone number.
• Let remediation specialists handle ongoing takedown requests for any data-broker listings that surface from this breach.

The Pandabuy incident shows how quickly shopping data turns into persistent identity risk once it leaves a company's servers. One breach can feed months of targeted attacks unless you actively break the chains that connect your details across the internet. Start your DoxxScan trial today; its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage—including children's gaming accounts—give you and your family the practical defense this type of exposure demands.