Wanelo, a social shopping platform that let users save and share products from online retailers, suffered a data breach in approximately December 2018. The attacker, GnosticPlayers, claimed responsibility alongside breaches of 44 other companies. The stolen data was listed for sale on dark web marketplaces in April 2019. The breach affected approximately 23.2 million user accounts. The exposed data included email addresses, names, physical home addresses, IP addresses, and passwords stored as MD5 or bcrypt hashes. Home addresses are particularly sensitive in this context, as users would not typically expect a product-discovery platform to carry that level of personal detail. Combined with shopping behavior and saved items, the exposed data can reveal demographic and lifestyle information. Weak MD5 password hashes are especially vulnerable to cracking, meaning many passwords may have been exposed in plaintext by the time the data circulated publicly. Wanelo made no prominent public disclosure and did not notify affected users before ceasing operations around 2019 to 2020. No regulatory action or litigation specific to this breach has been documented. People whose data was exposed face ongoing risks including phishing, account takeover on other services where they reused passwords, and potential physical-world risks tied to the exposure of home addresses.

Social shopping platforms collect user accounts, wish lists, browsing and save activity, purchase-intent signals, and social-engagement data tied to product discovery and e-commerce referrals.

Wanelo no longer operates. The platform shut down and its domains are no longer active as a functional service.