LuLu luluhypermarket.com LuLu data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In July 2024, data from the Emirati retailer LuLu was shared on a hacking forum. Have I Been Pwned lists 2,796,835 accounts with names, email addresses, phone numbers, physical addresses, orders and hashed passwords, after a 2022 backup also appeared.
View all 13,118 breaches- Breach date
- 6 Jul 2024
- Affected
- 2,796,835
- Data exposed
- Email addresses, Names, Passwords, Phone numbers, Physical addresses, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
LuLu is a retail chain based in the United Arab Emirates. In July 2024 about 190,000 email addresses and phone numbers were shared on a hacking forum. Have I Been Pwned says the next month the threat to leak the full database was carried out, and a backup from October 2022 with a further 2.6 million unique email addresses appeared. It lists 2,796,835 accounts in total. CSO Online covered the early leak.
Sources checked: haveibeenpwned.com, csoonline.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
The data included email addresses, names, phone numbers, physical addresses, orders and PBKDF2 password hashes. PBKDF2 is a method designed to make cracking passwords slow, which helps, but a short or reused password is still at risk.
What that lets criminals do
Orders, names and delivery addresses give scammers material for fake delivery and refund messages.
What to do
Change your LuLu password if you had an account, and any other account that shares it. Then treat unexpected messages about orders with care.
What to do if you were in it
- 1
Change your LuLu password, and any you reused
Passwords were stored with PBKDF2, which is slow to crack, but weak or reused ones are still at risk. Change the password on your LuLu account and on every other account where you used the same one. Use a different password for each site and turn on two-factor authentication wherever it's offered.
- 2
Expect phishing that mentions the breach
Emails, texts and calls that quote your name or a real purchase look more convincing. Don't click links or open attachments in unexpected messages; go to the company's site yourself instead. The FTC explains how to spot phishing.
- 3
Check order and delivery messages through the store
A message about an order, refund or delivery that quotes your details could be a scam. Open the store's site or app yourself instead of using the link. The FTC lists tips for avoiding scams.
- 4
Check whether your email or phone is in this and other breaches
Search your email address on Have I Been Pwned. A free Serus scan also checks breach databases and the dark web and alerts you when your details appear. Serus can't remove data from a breach, so the steps above matter most.
Frequently asked
Was I affected by the LuLu breach?
Have I Been Pwned lists 2,796,835 accounts. Search your email address there to see whether yours is included.
What was exposed in the LuLu breach?
Email addresses, names, phone numbers, physical addresses, orders and PBKDF2 password hashes.
Should I change my LuLu password?
Yes, if you had an account. Change it, and change it on any other site where you used the same password. Turn on two-factor authentication where you can.
Which LuLu is this?
This is the LuLu retail chain based in the United Arab Emirates, not the Lulu publishing platform or the LuLu firewall app.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
