Storenvy data breach: what happened and what to do

What happened

Storenvy, an online marketplace where independent sellers run their own shops, suffered a data breach in 2019. Have I Been Pwned (HIBP) dates it to April 2019 and added it to its database in February 2025, so many people only learned about it years later.

According to HIBP, part of the stolen records was posted to a hacking forum with cracked password hashes, while the full set of 23 million rows was put up for sale. Within those rows are 11,052,071 unique email addresses. Hackread reported on the leak in 2019.

What was exposed

HIBP lists these data types:

• Email addresses
• Usernames
• Passwords (as salted SHA-1 hashes)
• IP addresses
• Dates of birth
• Genders
• Geographic locations (the user's city)

A hash is a scrambled version of a password. SHA-1 is an old, fast scheme, which makes hashes easier to crack than ones made with modern methods. HIBP says some of the hashes were cracked and posted with the leak, so any simple password from a 2019 Storenvy account should be treated as known.

What criminals can do with it

Passwords are the immediate risk. Criminals take leaked email and password pairs and try them on other sites, a technique called credential stuffing. If you reused your Storenvy password on email, shopping or banking sites, those accounts are the target.

An email address with a date of birth, city and gender is also useful for phishing. A message that opens with your real birthday or hometown looks more trustworthy than a generic one, and a date of birth is a piece of data people use to verify who they are with banks and phone companies.

What the sources say about the company

The sources reviewed here don't include a public breach notice from Storenvy, and the figures reported elsewhere differ: some reports from 2019 mention smaller samples of the data. This page uses HIBP's numbers.

Who should act

If you ever had a Storenvy account, as a shopper or a seller, assume the email, username and hashed password were in the data. The breach is old, but the data doesn't expire: a password you used in 2019 and still use elsewhere is the main thing to fix.

How to check the rest of your accounts

Start with your main email account, because anyone who controls it can reset every other password. Look at its recent sign-ins and forwarding rules. Then check your password manager's breach report if it has one, which flags reused passwords. Finally, if you sold on Storenvy, look at the payment account you linked (PayPal or a bank) for activity you don't recognize.

If you can't remember whether you used the same password, assume you did and change it. It takes a few minutes per account, and the accounts that matter most are email, banking and anything that stores a card.