TL;DR: In October 2024 a hacker calling themselves "Satanic" offered a database linked to Hot Topic, BoxLunch and Torrid for sale. Have I Been Pwned confirmed 57 million unique email addresses, along with names, physical addresses, phone numbers, dates of birth, genders, purchases and partial card data (card type, expiry and last four digits). Full card numbers weren't listed. Check your email, expect targeted phishing, and watch your cards.
What happened
In October 2024 a threat actor using the name "Satanic" advertised a database on a hacking forum that it said belonged to Hot Topic and its sister brands BoxLunch and Torrid. Researchers at Hudson Rock reported that an employee computer at Robling, a retail data analytics provider, had been infected with info-stealing malware in September 2024, exposing credentials that appeared to include Snowflake cloud accounts. The hacker claimed missing multi-factor authentication was part of how they got in; that was a claim, not a confirmed finding, as TechRadar noted.
The seller claimed data on about 350 million customers. The verified number is smaller: Have I Been Pwned added the breach on 11 November 2024 with 57 million unique email addresses (56.9 million in its count).
What data was exposed
According to Have I Been Pwned:
- Names, email addresses and salutations
- Physical addresses and phone numbers
- Dates of birth and genders
- Purchase history
- Partial credit card data: card type, expiry date and the last four digits
Full card numbers and CVVs were not listed. But last four digits plus expiry are often used as identity checks by customer service teams, and they make fake "your order has a problem" messages very convincing.
How to check if you were affected
- Run your email through a breach lookup. Our free email exposure check checks known breaches including this one.
- Check every email you've used to shop at Hot Topic, BoxLunch or Torrid, including old ones. Our guide to checking multiple email addresses helps.
What to do now
- Expect phishing: emails and texts about orders, refunds, loyalty points or "account verification" that use your real name, address and purchases. Don't click; go to the store's site directly. See how to spot phishing.
- Watch your cards: set up transaction alerts and report anything odd.
- Change reused passwords if you used your Hot Topic password elsewhere; see what to do when a password leaks.
- Consider a credit freeze: your name, address and date of birth together are enough to start an identity theft attempt. See how to freeze your credit.
- If you're under 18 or a parent of one, check the child's credit too; see how to freeze a child's credit file.
Part of a bigger pattern
This breach fits a wave of attacks on retailers and cloud data platforms using stolen logins. The same lesson shows up in our coverage of the Under Armour breach and the M&S and Co-op attacks. For a wider view, see the biggest data breaches in history.
Frequently Asked Questions
Was there a Hot Topic data breach?
Yes. In October 2024 a hacker offered a database linked to Hot Topic, BoxLunch and Torrid. Have I Been Pwned confirmed 57 million unique email addresses.
What data was leaked in the Hot Topic breach?
Names, email addresses, physical addresses, phone numbers, dates of birth, genders, purchases and partial card data: card type, expiry date and last four digits.
Were full credit card numbers leaked?
Have I Been Pwned lists only partial card data: card type, expiry and the last four digits.
How did the Hot Topic breach happen?
Researchers linked it to info-stealing malware on a computer at Robling, a retail analytics provider, which exposed cloud account credentials. The hacker's claims about missing MFA were not independently confirmed.
What should I do if I was in the Hot Topic breach?
Watch for phishing that uses your real purchase details, set card alerts, change reused passwords and consider a credit freeze.
Sources
- Have I Been Pwned: Hot Topic data breach
- TechRadar: Millions of Hot Topic shoppers have data stolen by "Satanic" hacker