Peruvian Connection Breach

Executive Summary

• Victim: Peruvian Connection (International clothing retailer).
• Incident Date: Late November 2025.
• Threat Actor: WorldLeaks (Ransomware group).
• Status: Confirmed data extortion; threat actors have leaked the full data set.

What Was Leaked

According to our parse of the data, the following unique records were compromised:

• 1,000,000 Unique Emails
• 561,200 Unique Phone Numbers
• 1,200 Unique SSNs (Social Security Numbers)

Analysis of the Data

Here is what these specific numbers tell us about the breach and the risks involved:

1. 1,000,000 Unique Emails

• Who is in this list: This could represent the core global customer base, including newsletter subscribers and online account holders.
• The Specific Risk: "Whaling" / High-Value Phishing.
  • Peruvian Connection caters to an affluent demographic. Criminals know this and often target these specific email lists with sophisticated scams (e.g., fake "luxury shipping" notifications or high-end banking alerts) because the victims are presumed to have higher credit limits.

2. 561,200 Unique Phone Numbers

• Who is in this list: Customers who have placed orders.
  • The count is roughly half the size of the email list, which suggests this data could be tied to shipping and billing records (where a phone number is required for delivery) rather than general newsletter sign-ups.
• The Specific Risk: Shipping Scams.
  • Since the brand ships internationally, victims are highly vulnerable to texts claiming "Customs Fees Due" or "Package Delayed," designed to steal credit card details.

3. 1,200 Unique SSNs

• Who is in this list: Current and Former Employees.
  • Retailers rarely store customer SSNs. This count (1.2k) aligns with the staffing levels of a mid-sized retailer, likely covering the entire current workforce plus recent former employees.
• The Specific Risk: Identity Theft.
  • This is the most critical dataset. These 1,200 individuals are at immediate risk of financial identity theft (loans, credit cards) and tax return fraud.

Recommendations

For the 1,200 Employees (SSN Breach)

• Credit Freeze: Mandatory. Freeze credit files at Equifax, Experian, and TransUnion immediately.
• IRS Protection: Apply for an Identity Protection PIN (IP PIN) at irs.gov to prevent tax fraud.

For the 1 Million Customers (Email & Phone Breach)

• Verify Senders: Be suspicious of any email claiming to be from Peruvian Connection regarding "urgent order issues." Check the sender address carefully.
• Ignore "Customs" Texts: If you receive a text asking for a small fee to release a package, do not click the link. Log in to the official site to check order status directly.