Peruvian Connection Data Breach
Status: Confirmed
Breach Intelligence Summary
Entity: Peruvian Connection · Actor: WorldLeaks · Source: DataBreach.com / ObscureIQ intelligence
Attack: Ransomware via Phishing
Timeline: Breach (Oct, 2025) · Reported (Dec, 2025) · Leak (Dec, 2025)
Exposure: 1.1M+ records · Email, Phone Number, Name
Status: Confirmed · Risk: Low (Phishing / SIM swap)
Summary
Victim: Peruvian Connection (International clothing retailer). Incident Date: Late November 2025. Threat Actor: WorldLeaks (Ransomware group). Status:, Confirmed data extortion; threat actors have leaked the full data set.
What Was Leaked According to our parse of the data the following unique records were compromised:
1 000 000 Unique Emails 561 200 Unique Phone Numbers 1 200, Unique SSNs (Social Security Numbers)
Analysis of the Data Here is what these specific numbers tell us about the breach and the risks involved: 1. 1 000 000 Unique Emails
Who is in this list: This could represent the core global customer base including newsletter subscribers and online account holders. The Specific Risk: , “Whaling” / High-Value Phishing.
Peruvian Connection caters to an affluent demographic. Criminals know this and often target these specific email lists with sophisticated scams (e.g., fake “luxury shipping” notifications or high-end banking alerts) because the victims are presumed to have higher credit limits.
2. 561,200 Unique Phone Numbers
Who is in this list:, Customers who have placed orders.
The count is roughly half the size of the email list which suggests this data could be tied to shipping and billing records, (where a phone number is required for delivery) rather than general newsletter sign-ups.
The Specific Risk: Shipping Scams.
Since the brand ships internationally, victims are highly vulnerable to texts claiming “Customs Fees Due” or “Package Delayed,” designed to steal credit card details.
Who is in this list: Current and Former Employees.
Retailers rarely store customer SSNs. This count (1.2k) aligns with the staffing levels of a mid-sized retailer, likely covering the entire current workforce plus recent former employees.
The Specific Risk: Identity Theft.
This is the most critical dataset. These 1 200 individuals are at immediate risk of financial identity theft (loans credit cards) and tax return fraud.
Recommendations For the 1 200 Employees (SSN Breach)
Credit Freeze: Mandatory. Freeze credit files at Equifax , Experian , and TransUnion immediately. IRS Protection: Apply for an Identity Protection PIN (IP PIN) at irs.gov, to prevent tax fraud.
For the 1 Million Customers (Email & Phone Breach)
Verify Senders:, Be suspicious of any email claiming to be from Peruvian Connection regarding “urgent order issues.” Check the sender address carefully., Ignore “Customs” Texts: If you receive a text asking for a small fee to release a package do not click the link. Log in to the official site to check order status directly.
About Peruvian Connection
Peruvian Connection is the organization affected by this breach. User data may have been generated through account creation, service usage, or business operations.
If you have interacted with Peruvian Connection in any capacity, your data may be included in this breach.
Threat Actor: WorldLeaks
This breach has been attributed to WorldLeaks. The group is known for data theft campaigns targeting organizations through various intrusion methods.
- Phishing
Breach Exploitation Status
Low
Status
Unknown
Possible
Unknown
Unknown
Unknown
1–3 years
Email addresses and usernames persist but credentials may rotate. Phishing risk remains elevated during this window.
Data Points Exposed
Dark Web Verification
Status: Confirmed
- Dataset containing approximately 1.1M+ records has been identified in breach intelligence sources.
- The data is indexed and searchable across breach notification platforms.
Impact
This breach carries low risk due to the nature of exposed data fields and the scale of affected records.
- Targeted phishing referencing Peruvian Connection accounts or services
- SIM-swap attempts where phone numbers are present
- Data broker enrichment and resale
Recommendations for Impacted Individuals
If you believe your information may be included:
Non-clients may request a breach impact review.
Peruvian Connection account updates
Password reset requests
Verify directly through official channels.
Email compromise is often the first pivot point.
Frequently Asked Questions
In Oct, 2025, Peruvian Connection experienced a data breach that resulted in the exposure of approximately 1.1M+ records containing personal information.
The exposed data includes Email, Phone Number, Name.
Approximately 1.1M+ records were affected based on current breach intelligence.
Yes. This breach is treated as confirmed based on data observed in breach intelligence platforms.
Data circulation has been reported across breach-sharing channels. Downstream exploitation risk exists based on the nature of the exposed fields.
Rotate passwords associated with Peruvian Connection, enable multi-factor authentication on email and financial accounts, and monitor for suspicious activity.
Protect Yourself
Check If You’re Affected
Enter your email to check if your data appears in this breach.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-net-worth individuals face elevated risk. Our team provides full-spectrum exposure audits and threat monitoring.
Corporate Accountability
Organizations that collect personal data have a duty to implement reasonable safeguards and to notify affected individuals when breaches occur.
Scope assessments may evolve as investigations continue. Users should not rely solely on early estimates when making risk decisions.
ObscureIQ Advisory
We combine proprietary dark web access with commercial and restricted breach intelligence to verify exposure and assess real-world risk.
- A public-facing individual
- A high-profile executive
- A customer of Peruvian Connection
- Or simply concerned about credential reuse
We can confirm whether your information is circulating and evaluate downstream threat vectors.