Blooms Today bloomstoday.com Blooms Today data breach: what happened and what to do
Records from the online florist Blooms Today were offered for sale in April 2024. Have I Been Pwned lists 3,184,010 accounts, with emails, names, phone numbers, physical addresses and partial card data exposed.
View all 13,115 breaches- Breach date
- 11 Nov 2023
- Affected
- 3,184,010
- Data exposed
- Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Blooms Today is an online florist. In April 2024 a seller listed 15 million of its records on a hacking forum. The most recent data dates to 11 November 2023, and Have I Been Pwned (HIBP) added the breach on 3 September 2024.
What happened
HIBP says Blooms Today did not respond when contacted about the incident. CyberInsider reported that the 15 million records cover about 3.2 million unique email addresses.
What was exposed
HIBP lists 3,184,010 accounts with email addresses, names, phone numbers, physical addresses and partial credit card data. The card data was the card type, four digits of the number and the expiry date, and HIBP says it was not enough to make purchases.
Florist customers often send flowers to someone else, so the records can tie your name and address to an occasion and a recipient. Scammers use that kind of detail for fake delivery problems, refund requests and "your order was declined" messages.
What to do
Be skeptical of any message about a flower order, delivery or refund, and check your card statements. Your card issuer can replace a card if you're worried.
What to do if you were in it
- 1
Check card statements and consider a new card
Only part of the card number leaked, which isn't enough to make purchases. If you want certainty, ask your card issuer for a replacement.
- 2
Watch for package and delivery scams
A leaked name, phone number and home address make convincing fake delivery and order messages. Check order status in the retailer's own app or site, not through a link in a message.
- 3
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls as suspect, especially ones that name the company or offer help with the breach. Don't click links in them; go to the company's site yourself.
- 4
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the Blooms Today breach?
Look up your email on Have I Been Pwned, or run a free Serus scan. HIBP lists 3,184,010 accounts.
What was exposed?
Email addresses, names, phone numbers, physical addresses and partial credit card data.
Can someone use the card data?
HIBP says the breach didn't expose enough card data to make purchases.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
