Lookiero lookiero.com Lookiero data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In August 2024, a data set from the styling service Lookiero, dating back to March 2024, was posted online. HIBP counts about 5 million unique email addresses, many with names, phone numbers and physical addresses.
View all 13,118 breaches- Breach date
- 27 Mar 2024
- Affected
- 4,981,760
- Data exposed
- Email addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Lookiero is a Spanish online personal styling service. In August 2024, a data set attributed to it was posted to a hacking forum. Have I Been Pwned (HIBP) says the data dates back to March 2024 and holds 4,981,760 unique email addresses, with many records also including names, phone numbers and physical addresses. HIBP added it on 30 August 2024.
When HIBP contacted Lookiero about the incident, the company said it would "look into it and get back to you if necessary". HIBP's entry records no further statement from the company.
Reports differ on what else was in the file. CyberInsider reported that it also contained usernames, encrypted passwords and payment-related data. HIBP's entry lists only email addresses, names, phone numbers and physical addresses, and those are the fields this page relies on. If you used Lookiero, it's reasonable to act as though more could be exposed.
What this lets a scammer do: with your name, address and phone number next to your email, they can write phishing emails and texts that look like Lookiero order or delivery notices, or phone you while quoting your details. Contact data also makes it easier to target you for a SIM swap attempt, where a criminal tries to get your number moved to their SIM card.
The steps below focus on those risks.
Sources checked: haveibeenpwned.com, cyberinsider.com, consumer.ftc.gov
Last verified against the official page:
What to do if you were in it
- 1
Treat messages about Lookiero orders and deliveries with suspicion
Don't click links or open attachments in unexpected messages. The FTC explains how to recognize and report phishing: https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams.
- 2
Change your Lookiero password and any you reused
Some reports say passwords were in the file, so change it and anywhere you reused it. Use a unique password per site.
- 3
Turn on two-factor authentication
Enable it on your email and any account tied to the exposed address.
- 4
Protect your phone number
Ask your mobile carrier about a PIN or port-out lock on your account, and never share one-time codes with anyone who contacts you.
- 5
Check whether payment details were used
If you saved a card with Lookiero, review statements and tell your card issuer about charges you don't recognize.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you know which accounts to look at first.
Frequently asked
Was I affected by the Lookiero data breach?
HIBP lists 4,981,760 unique email addresses. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Per HIBP: email addresses, names, phone numbers and physical addresses. Some press reports claim more, including payment-related data.
Has Lookiero confirmed the breach?
HIBP says that when contacted, Lookiero replied it would look into it and get back if necessary. HIBP's entry records no further response.
Should I change my password?
Yes, as a precaution. Change it and any site where you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
