Hot Topic, the U.S. pop-culture specialty retailer, suffered a data breach in October 2024 affecting nearly 57 million customers across its Hot Topic, Torrid, and BoxLunch brands. A threat actor known as "Satanic" claimed responsibility and listed the stolen data for sale on cybercrime forums, initially asking $20,000 before dropping the price to $3,500. The breach is believed to have originated from an infostealer malware infection on a computer belonging to an employee of Robling, a third-party retail analytics firm used by Hot Topic. That malware harvested credentials that granted unauthorized access to Hot Topic's cloud infrastructure, including platforms used to store and analyze customer data. The exposed records included full names, email addresses, home addresses, phone numbers, dates of birth, purchase histories, and partial credit card information, specifically card type, expiration dates, and last four digits. Purchase history is particularly sensitive because it reveals shopping behavior tied to real identities, giving bad actors the detail they need to craft convincing phishing messages or impersonate the retailer to trick customers into handing over more information. Hot Topic has not issued a comprehensive public breach notification. The attacker also reportedly demanded a $100,000 ransom to remove the data from public forums, and it is unclear whether that data remains accessible. Affected customers face elevated risk of phishing, account takeover, and identity-based scams. Anyone who shopped at Hot Topic, Torrid, or BoxLunch should treat unsolicited emails or texts referencing their purchase history with suspicion, and consider updating passwords and monitoring any payment accounts linked to those stores.

Retail platforms collect customer profiles including names, emails, purchase history, payment data, and loyalty program information tied to consumer behavior.

Hot Topic appears to be operating as part of a broader multi-brand retail structure that includes affiliates such as BoxLunch and Her Universe, and its current privacy policy reflects a consolidated “Hot Topic Brands” approach across websites, apps, stores, and in-person events. In practical terms, that suggests a mature omnichannel retail operation with shared governance over customer data across several adjacent consumer brands.