- A dark web seller indicates they have over 50 million records, including names, emails, phone numbers, addresses & transaction information of customers of Kleinanzeigen.
- A breach of such data could lead to phishing and account takeover attacks, as well as financial fraud against users of the online classified service.
- The claims remain unverified, Kleinanzeigen has not confirmed whether the data is genuine or linked to its systems.
A hacker on an underground forum has posted that they have acquired users’ personal data from Kleinanzeigen, a popular online classified site in Germany. The seller claims that the stolen data includes over 50 million user records dating back to last year.
Kleinanzeigen is a very popular marketplace in Germany for people to buy and sell second-hand items, and so it has a very large database of personal data of users such as full names, email address, phone number, transaction history, etc. If true, the breach will impact millions of users.
The seller claims the exposed information is sensitive personal details, such as full names, email addresses, telephone numbers, street addresses, purchase dates, transaction details, payment descriptions, and amounts in euros. The dataset also allegedly contains masked payment card numbers and partially hidden account identifiers.
What the Stolen Data Contains
The threat actor says the dataset includes more than 50 million records from 2025, this suggests the data is relatively recent. The information covers user profiles and transaction activities on the platform.
The presence of the users’ first and last names, email address, phone numbers and other details in the dataset can assist criminals in their fraudulent acts, such as creating phishing emails and attempting to scam people into sending money to them.
Transaction details are particularly valuable. The data includes purchase dates, payment descriptions, and amounts in euros, criminals can use this information to understand users’ buying habits and financial capacity.
Masked payment card numbers and account identifiers appear in the dataset. While these are partially hidden, criminals can sometimes combine them with other information to piece together complete details. The combination of transaction history with contact information makes fraud campaigns more effective.
Why Transaction Data Matters
The inclusion of purchase history and payment amounts makes this breach particularly risky. When cybercriminals have complete knowledge of the items you purchased, the period you purchased them and how much you paid, they can use that information in developing convincing criminal activities. Also, they may pretend to be the seller or buyer of the item.
To conduct such activities, they will refer to your actual purchases, send messages informing you that there was a problem from a previous purchase, they could say a refund failed or that a payment was processed incorrectly. The victim is more likely to fall for this because the scammer has accurate details about the transaction.
Transaction data also reveals spending habits and financial capacity. Criminals can identify high-value targets who make expensive purchases. These individuals may be more likely to have significant financial resources worth stealing.
The masked payment card numbers add another risk. While the full numbers are hidden, criminals can sometimes use the visible digits to guess or verify card information. They can combine this with data from other breaches to build complete payment profiles.
Risks to Affected Users
The leaked data creates several risks for Kleinanzeigen users. Phishing attacks are likely to increase. Scammers can craft convincing messages using accurate personal details and transaction information.
Account takeover is another concern. Attackers may use the stolen data to access users’ Kleinanzeigen accounts. They might also try to break into other online accounts where users have reused passwords.
Financial fraud becomes more likely with this type of data. Criminals can use transaction history and masked payment details to impersonate victims, they might attempt to make unauthorized purchases or access financial accounts.
Social engineering attacks also become easier. Scammers can use personal information to gain victims’ trust during phone calls or messages. This can lead to further data disclosure or financial losses.
The presence of masked payment card numbers adds another risk dimension. While data breaches remain a serious threat, there is some good news on the cybercrime front, a global crackdown has led to a 35% drop in ransomware payments in 2024, showing that law enforcement efforts are making a difference.
While a complete view of the card number and other information may not be available, it’s possible for criminals to utilize them for other fraudulent businesses. is possible. They can combine this information and incorporate previously breached information to develop detailed profiles.
The claims remain unverified at this stage, Kleinanzeigen has not issued a public statement confirming or denying the breach.
