Hot Topic hottopic.com Hot Topic data breach: what happened and what to do
Data tied to Hot Topic, and its sister brands, surfaced in October 2024. Have I Been Pwned loaded 56,904,909 accounts with names, emails, phone numbers, addresses, dates of birth and purchases, plus partial card data.
View all 13,115 breaches- Breach date
- 19 Oct 2024
- Affected
- 56,904,909
- Data exposed
- Dates of birth, Email addresses, Genders, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases, Salutations
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Hot Topic sells band shirts and pop-culture merchandise, and a lot of shoppers have an account there. In October 2024, a dataset claimed to come from the retailer's systems began circulating. After analysing it, Have I Been Pwned (HIBP) loaded 56,904,909 accounts on 11 November 2024, which is why most outlets round the story to 57 million.
What happened
HIBP dates the breach to 19 October 2024. Coverage from TechCrunch and BleepingComputer says the data covered customers of Hot Topic and its sister brands, Box Lunch and Torrid. The person offering the data first claimed a much larger haul, but analysis narrowed it to about 57 million unique accounts. At the time of that reporting, Hot Topic had not publicly confirmed the breach.
Security researchers linked the likely cause to stolen login credentials at a third-party analytics provider, where cloud data accounts lacked multi-factor authentication. Treat that as a suspected cause from researchers, not a finding published by the retailer.
What was exposed
HIBP lists nine kinds of data: dates of birth, email addresses, genders, names, partial credit card data, phone numbers, physical addresses, purchases and salutations. Reports describe the card information as card type, expiry date and the last four digits, not full card numbers. About 25 million of the records reportedly included it.
What that lets criminals do
This is a broad profile. A name, birth date, home address and phone number together are the raw material for identity theft, because they answer many of the questions banks and phone carriers use to check who is calling. Dates of birth do not change, so they stay useful to criminals for life.
The purchase history adds credibility to scams. A message that references the kind of order you really placed looks like it came from the shop. Expect fake order problems, refund offers and "verify your account" emails.
Partial card data cannot be used to pay for things on its own, but the last four digits and expiry date let a scammer sound legitimate on a phone call that claims to be your bank. If someone calls and reads you part of your card number, hang up and call the number on the back of your card.
The company's response
Hot Topic has not published a detailed public account of the incident in the coverage reviewed, and there is no HIBP statement from the company. Without an official notice, the figures you can rely on are the ones HIBP verified from the dataset itself.
Where the data goes from here
Datasets like this get resold and merged into larger collections. Changing your password does nothing for the exposed birth date or address, so the useful moves are watching your credit, freezing it if you want a hard stop on new accounts, and treating unexpected messages with suspicion.
What to do if you were in it
- 1
Change your Hot Topic password and anywhere you reused it
HIBP does not list passwords for this breach, but retail accounts are a common source of reused ones. Set a unique password and turn on two-factor authentication where it is offered.
- 2
Expect phishing about orders, refunds and your account
Messages that mention a real purchase or your name are likely to be built from this data. Go to the site by typing the address instead of using a link in a message or text.
- 3
Freeze your credit at all three bureaus
A birth date, name and address are enough to open accounts in your name. A freeze at Equifax, Experian and TransUnion is free, takes a few minutes online and does not affect your score. Lift it when you need to apply for credit.
- 4
Watch card statements and hang up on card-number calls
Partial card data makes bank-impersonation calls sound real. If a caller reads you part of a card number, end the call and phone the number printed on your card.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next one early. It can't remove data from breach dumps, which is why the other steps here matter.
Frequently asked
Was I affected by the Hot Topic data breach?
HIBP lists 56,904,909 accounts. Search your email on Have I Been Pwned or run a free Serus scan. Customers of Box Lunch and Torrid may also appear.
What was exposed in the Hot Topic breach?
Dates of birth, email addresses, genders, names, partial credit card data, phone numbers, physical addresses, purchases and salutations.
Were full credit card numbers exposed?
HIBP lists partial card data. Reports describe it as card type, expiry date and last four digits, not full numbers.
Should I change my password?
HIBP does not list passwords here, but change it if you reused it anywhere. The bigger risks are phishing and identity theft from the birth date and address.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
