NewAI pentesting that proves every finding
INSECUREWEB

Data Breach News2 min read

NicoVIP Database Leak: 90K Customers & 360K Orders Exposed

By InsecureWeb Team

This report reflects observations of dark web activity. InsecureWeb makes no representations regarding the accuracy of this data.

NicoVIP Database Leak: 90K Customers & 360K Orders Exposed

Data Breach Summary

Attacker @Satanic has leaked the NicoVIP database, reportedly breached in March 2025, exposing:

  • 90K customer records — including ID, title, first name, last name, email, group, company, sales, active status, newsletter subscription, partner offers, registration date, and last visit
  • 360K order records — including ID, reference number, new customer flag, shipping info, client, total amount, payment method, status, and order date

The leak was posted on dark web forums like BreachForums and XReactor.

Where and How?

The data dump appeared in March/June 2025 on platforms such as BreachForums.st and xReactor:

  • BreachForums describes “NicoVIP Database – Leaked, Download!” by @Satanic
  • XReactor confirms release on July 6, 2025, also attributing it to Satanic, with the same record counts

Company Data Breach History

There are no known previous breaches involving NicoVIP or its database. This appears to be the first public disclosure concerning NicoVIP’s customer and order data.

Further Action

🔸 Duplicate check: Record metadata (size, schema) to detect reposts.
🔸 Monitor forums: Keep track of growing activity on platforms like XReactor and BreachForums.
🔸 Notify impacted customers: If possible, alert NicoVIP users to potential phishing, account takeover, or payment fraud.
🔸 Security advice: Encourage resetting passwords, enabling MFA, and monitoring financial transactions.

Recommendations for Users

✅ Use unique, strong passwords — avoid reusing across sites.
✅ Enable two-factor authentication where available.
✅ Be alert to suspicious emails/links referencing NicoVIP orders or accounts.
✅ Review banking and credit card statements for unauthorized charges.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.

More breach reports