20K User Records Leaked from Yalla Tager Marketplace

Data Breach Summary

A sensitive customer database from Yalla Tager, an Egyptian e-commerce marketplace, was leaked on darkforums.st by a user known as chucky_bf in August 2025. The exposed dataset, stored in .csv format, contains information on approximately 20,000 users, including full names, emails, phone numbers, locations, and customer details such as group type and business classification.

The breach reveals detailed personal data like ZIP codes, cities, and business shop names in certain entries, raising immediate privacy concerns. Notably, some customers’ data includes phone numbers and interests, making this dataset potentially valuable for phishing or social engineering attacks.

---

Where and How?

The leak surfaced on the dark web forum darkforums.st, where the attacker posted both HTML and CSV samples to verify the breach. The data appears to originate from account registration logs on the Yalla Tager main website, used by both individual customers and wholesale vendors. Given the detailed structure of the information and the presence of recent registration timestamps (as late as July 21, 2025), the data seems current and authentic.

Company Data Breach History

There are no prior reported data breaches involving Yalla Tager, making this the first known exposure of its user data. However, the breach shows a lack of adequate safeguards for user privacy and raises questions about whether data was being stored securely or monitored for unauthorized access.

---

Recommendations for Personal Data Protection

How Users Can Protect Their Information

Impacted users should take immediate action to protect their accounts:

• Change passwords for accounts tied to their leaked email addresses.
• Avoid reusing passwords across multiple platforms.
• Be wary of suspicious messages or emails, especially those asking for personal or financial information.
• Enable two-factor authentication (2FA) on all accessible platforms.
• Monitor email inboxes and mobile numbers for phishing or scam attempts.
• Consider using email breach monitoring tools to detect future leaks.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.