Lush
Data Breach on January 26, 2024
| Data Breach Report | ||
|---|---|---|
| Victim | lush.com | |
| Claimed By | Akira | |
| Date Discovered | Jan 26, 2024 | |
| Description | Lush is a cosmetic store specializing in the retail of bath bombs, hair products, makeup and more. | |
| Leak Size | 110GB |
Credential Exposure for lush.com
We've indexed 346 @lush.com accounts from external breaches, plus 2,083 credentials for lush.com itself.
Last checked Oct 11, 2026
| @lush.com addresses from external breaches | |
|---|---|
| Third-party breaches | 257 accounts · across 77 breaches · 222 with a plaintext password · most recent Dec 18, 2025 |
| Combo lists | 160 accounts · most recent Oct 10, 2026 |
| Phishing pages | 29 accounts · most recent Aug 13, 2026 |
| Passwords for lush.com accounts | |
|---|---|
| Infostealer logs | 1,077 logins · 843 infected devices · most recent Oct 10, 2026 |
| Combo lists | 1,046 logins · most recent Oct 10, 2026 |
Logins may belong to customers or to staff, and the data doesn't say which. None of this is necessarily connected to the ransomware attack above.
Is your organization next?
Lush was breached. Check if your company's credentials have been exposed in this or other data breaches.
Check your exposure →Continuous dark web monitoring alerts you when we find leaked credentials or session tokens for your company.