{"id":886956,"date":"2026-01-22T18:12:05","date_gmt":"2026-01-23T00:12:05","guid":{"rendered":"https:\/\/newsycanuse.com\/index.php\/2026\/01\/22\/online-retailer-pccomponentes-says-data-breach-claims-are-fake\/"},"modified":"2026-01-22T18:12:05","modified_gmt":"2026-01-23T00:12:05","slug":"online-retailer-pccomponentes-says-data-breach-claims-are-fake","status":"publish","type":"post","link":"https:\/\/newsycanuse.com\/index.php\/2026\/01\/22\/online-retailer-pccomponentes-says-data-breach-claims-are-fake\/","title":{"rendered":"Online retailer PcComponentes says data breach claims are fake"},"content":{"rendered":"
\n

\"Online<\/p>\n

PcComponentes, a major technology retailer in Spain, has denied claims of a data breach on its systems impacting 16 million customers, but confirmed it suffered a credential stuffing attack.<\/p>\n

The Spanish e-commerce company specializes in the sale of\u00a0computers, laptops, peripherals, and hardware, and has an estimated 75 million unique marketplace visitors per year.<\/p>\n

Yesterday, a threat actor named \u2018daghetiaw\u2019 published what they claimed to be a customer database stolen from PcComponentes, containing 16.3 million records. The threat actor leaked 500,000 records and offered to sell the rest to the highest bidder.<\/p>\n

\"Wiz\"<\/a>\n<\/p>\n

The leaked data contains order details, physical addresses, full names, phone numbers, IP addresses, product wish-lists, and customer support messages exchanged with the firm via Zendesk.<\/p>\n

\n
\"PcComponents
PcComponents data leak on hacker forums<\/strong>
Source: BleepingComputer<\/em><\/figcaption><\/figure>\n<\/div>\n

In an announcement today, PcComponents says that it investigated a possible breach of its systems, but its security experts found no evidence of unauthorized access.<\/p>\n

“There has been no illegitimate access to our databases or internal systems,” the company assures, adding that “the figure of 16 million supposedly affected customers is false, as the number of active PcComponentes accounts is significantly lower.”<\/p>\n

The company also underlined that no financial details or customer passwords are stored on its systems.<\/p>\n

However, PcComponentes admitted that its investigation discovered evidence of a credential stuffing attack on its platform. This means that a threat actor tried email addresses and passwords from other security breaches or leaked databases to find PcComponentes accounts.<\/p>\n

Credential stuffing attacks are typically automated and rely on large volumes of reused login credentials from other services.<\/p>\n

An investigation from threat intelligence company Hudson Rock discovered that the attackers likely collected the login data from computers infected with info-stealing malware.<\/p>\n

“Every single email we checked from the threat actor\u2019s sample was found in existing infostealer logs,” Hudson Rock says<\/a> in a post today, adding that some of the logins were as old as 2020.<\/p>\n

A\u00a0screenshot that Hudson Rock published shows a set of six email addresses that were verified and all of them\u00a0were marked as previously compromised in infostealer infections.<\/p>\n

According to PcComponentes\u2019 announcement<\/a>, the following data was exposed for a small number of compromised accounts:<\/p>\n