Dennis Kirk denniskirk.com Dennis Kirk data breach: what happened and what to do
In October 2024 almost 20GB of data from motorcycle supplies store Dennis Kirk circulated online, dating to September 2021. Have I Been Pwned counts 1,356,026 accounts: emails, names, phone numbers, postcodes and purchases.
View all 13,115 breaches- Breach date
- 4 Sept 2021
- Affected
- 1,356,026
- Data exposed
- Email addresses, Geographic locations, Names, Phone numbers, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Dennis Kirk sells motorcycle, ATV and snowmobile parts and gear online. In October 2024, almost 20GB of its data circulated, with records dating back to September 2021. Have I Been Pwned (HIBP) dates the breach to 4 September 2021, added it on 5 November 2024 and counts 1,356,026 accounts.
What happened
HIBP says the data held 1.3 million unique email addresses, along with purchases from the store, customer names, phone numbers and postcodes. News coverage reports that the person circulating the data claimed a bigger set, about 12.2 million entries, and that HIBP received only a fraction. The 1.3 million figure is the one HIBP verified.
HIBP also states that Dennis Kirk did not respond to multiple attempts to make contact about the breach. So there's no public company notice behind the figures here.
What was exposed
HIBP lists email addresses, geographic locations, names, phone numbers and purchases. The location data in the description is postcodes.
No passwords or payment card details are listed. The purchase history is the unusual part: it records what each customer bought.
What that lets criminals do
A purchase list lets a scammer write a message that matches something you really bought. "There's a problem with your order of a helmet and jacket" is a convincing hook when you did buy gear from the store. Fake refund, delivery and "confirm your payment" messages follow the same pattern.
Your name, phone number and postcode together help a caller sound like they know you. They can open with your name and area and ask you to confirm other details, which is how a fraud call collects what it doesn't have yet.
Shoppers of a specialist store are also a known group. Motorcycle owners hold valuable equipment, and a purchase record says what kind. That's a minor risk for most people, but a reason to be careful with delivery and storage details if you've shared them.
The company's response
According to HIBP, none. The company didn't answer its attempts at contact, and the entry is the main record of the incident.
How to check
Search your email address on HIBP, using the address you used to order. If it's listed under Dennis Kirk, assume your order history and contact details are known to others.
Dates matter here: the data runs up to September 2021. An address you've stopped using may still be listed, and a phone number that still reaches you is the part to watch.
Where to start
You don't need to reset anything because of this breach, since no passwords are listed. The useful habit is to treat any message about a past order as unproven until you've checked it on the retailer's own site, and to ignore calls that ask you to confirm your details.
What to do if you were in it
- 1
Expect phishing that uses your details
Emails, texts and calls that mention your name, employer or phone number are more believable. Don't click links in unexpected messages. Go to the company's site yourself, and treat urgent requests for money or codes as a red flag.
- 2
Treat order and delivery messages with suspicion
If a text or email about an order, refund or delivery arrives out of the blue, don't use its links. Go to the retailer's site or your own account and check there.
- 3
Check your card statements for the period
No card details are listed in the entry, but if a payment you don't recognise appears, tell your card issuer.
- 4
Don't confirm personal details to callers
A caller who knows your name and postcode hasn't proved who they are. Hang up and call back on an official number.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It checks breach databases for your email address and phone number and shows which breaches include you, so you know which passwords and accounts to deal with first.
Frequently asked
Was I affected by the Dennis Kirk breach?
Search your email address on Have I Been Pwned. It lists 1,356,026 accounts for Dennis Kirk.
What was exposed?
Email addresses, locations (postcodes), names, phone numbers and purchases.
Were passwords or cards exposed?
HIBP lists neither.
Did Dennis Kirk respond?
HIBP says the company did not respond to multiple attempts to contact it about the breach.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
