250 dollars for 3 million customers’ fake data
Someone on a darknet hacker forum is offering to sell personal data belonging to 3.45 million customers – supposedly originating from Digitec Galaxus. For 250 dollars. The claim that the data came from us is entirely made up.
With a logo, a price and contact details for queries, the darknet listing resembles the kind of product page you’d see on marketplaces like eBay, Ricardo or Tutti. Only, this listing doesn’t describe a used coffee maker. Instead, it’s offering up personal data belonging to 3.45 million customers, supposedly from Galaxus and Digitec. The asking price? 250 dollars, payable in cryptocurrency.
David Capela from Hackstle, a security firm that trawls forums potentially containing stolen company data, was the one to flag up the listing to us. Capela reached out to a member of our security team on LinkedIn to share his discovery. That same day, we launched an internal investigation. Whenever a potential security incident is reported, a specially assembled team reviews the report and decides what action to take.
The non-existent insider
Capela contacted the poster, posing as a potential buyer. Using darknet forum slang, he asked them about the origin of the data over Telegram. The poster quickly responded, claiming an insider had given them access to a developer interface, with records dating up to September 2026. When asked what type of database it was, the poster confirmed it was a centralised internal customer database.
Sounds like a coherent enough story, right? Unless, that is, you check the data.
What a data sample revealed
To make the data seem more enticing, the poster made a sample – i.e. a few lines of the dataset – available online. This contained information such as names, e-mail addresses, postal addresses, customer numbers and the total amount each customer had spent over the past 12 months. When we compared the sample to our actual internal records, it soon became apparent that the data was fake: «When we cross-checked the customer numbers, registration dates and order details, we didn’t find a single match» says Martin Wrona, a security engineer at Digitec Galaxus.
Dig a little deeper, and the veracity of the data gets even more dubious. According to the sample, one customer had an order delivered to a PickMup box (a Migros collection point) in June 2026. The trouble is, we scrapped the option to do that in 2024. This means the so-called order went through a channel that no longer existed at Galaxus at the time. The product categories given in the dataset aren’t right either. It mentions «Home & Garden» and «Computers & Laptops», but Galaxus uses different names for these product categories. Just an hour and a half went by between the incident being reported and Martin’s team giving the all-clear.
«To people outside the company, the data may have seemed legit,» says Martin. «However, as soon as it’s compared to data that only we could have, it no longer stands up.» In other words, our customer database was definitely never exported. «That means there’s no need for our customers to take any action.»
However, the sample did contain e-mail addresses registered with us. This might sound alarming at first, but it’s put into perspective when you consider the scale at which we operate. Over the past 25 years, more than five million Galaxus and Digitec customer accounts have been created. «It doesn’t surprise me that some of these e-mail addresses match our own records,» says Martin. «It’s likely a compilation of older leaks containing Swiss addresses, supplemented with fabricated information that could’ve originated from us.»
Lists like these are still useful to criminals. A collection of genuine Swiss e-mail addresses can be enough to send out deceptively real-sounding phishing e-mails. After all, hackers don’t need customer numbers or order histories to do that. «That’s why we regularly warn people about these kinds of scams,» says Martin.
Strong brands are an easier sell
So, why would these apparent hackers claim their fake data came from us, and not some other company? «A dataset needs a brand. Otherwise, it won’t sell,» says Martin. A list branded with a household name generates more revenue than one seemingly compiled using data from a hundred small web shops or old leaks.
This particular incident is just one of a series of similar cases involving well-known Swiss brands. In early September, a Comparis dataset containing 190,000 contacts turned out to be a fake. This followed a previous fake data leak of 2.8 million Betty Bossi customer records. «Scammers scam scammers – it’s been happening ever since the internet was invented,» says Martin. Since the data didn’t come from Digitec Galaxus, we won’t be pressing charges or notifying the Swiss Federal Office for Information Security.
In a nutshell, there’s been neither a cyber attack nor a data breach at Digitec Galaxus. We have no connection to the data being sold on the hacker forum.
At Digitec and Galaxus, I’m in charge of communication with journalists and bloggers. Good stories are my passion – I am always up to date.
News about features in our shop, information from marketing and logistics, and much more.
Show all
