Piping Rock pipingrock.com Piping Rock data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In April 2024, 2,103,100 email addresses from the online health products store Piping Rock were posted on a hacking forum, per Have I Been Pwned. The data also included names, phone numbers and physical addresses.
View all 13,118 breaches- Breach date
- 24 Apr 2024
- Affected
- 2,103,100
- Data exposed
- Email addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Piping Rock is an online health products store. In April 2024, customer data was publicly posted on a hacking forum. Have I Been Pwned lists 2,103,100 email addresses. Its entry says the account that posted the data had posted other breaches too, which all appear to have come from the Shopify service used by the respective websites. Cybernews covered the leak.
Sources checked: haveibeenpwned.com, cybernews.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
The data included email addresses, names, phone numbers and physical addresses. Have I Been Pwned lists no passwords or card numbers in this breach.
What that lets criminals do
A name, phone number and home address together are what a scammer needs to write a convincing text or make a convincing call. Because this is a store that sells health products, scam messages may mention an order, a refund or a supplement. A postal address tied to your name is also the kind of detail people-search sites collect.
What to do
Change your password only if you reused it elsewhere. The bigger job is spotting contact scams.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Emails, texts and calls that quote your name or a real purchase look more convincing. Don't click links or open attachments in unexpected messages; go to the company's site yourself instead. The FTC explains how to spot phishing.
- 2
Be wary of order or refund messages
A text or email about a Piping Rock order, a refund or a delivery problem may be a scam that uses the leaked details. Contact the store through its own website rather than the message. The FTC explains how to recognize phishing.
- 3
Change your Piping Rock password, and any you reused
Passwords aren't listed in this breach, but reuse is common. Change the password on your Piping Rock account and on every other account where you used the same one. Use a different password for each site and turn on two-factor authentication wherever it's offered.
- 4
Check whether your email or phone is in this and other breaches
Search your email address on Have I Been Pwned. A free Serus scan also checks breach databases and the dark web and alerts you when your details appear. Serus can't remove data from a breach, so the steps above matter most.
Frequently asked
Was I affected by the Piping Rock breach?
Have I Been Pwned lists 2,103,100 email addresses. Search yours there to see whether it is included.
What was exposed in the Piping Rock breach?
Email addresses, names, phone numbers and physical addresses.
Should I change my Piping Rock password?
Passwords aren't listed in this breach. Change it anyway if you reused it on other sites, and turn on two-factor authentication where offered.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
