Lush
Data Breach on January 26, 2024
| Data Breach Report | ||
|---|---|---|
| Victim | lush.com | |
| Claimed By | Akira | |
| Date Discovered | Jan 26, 2024 | |
| Description | Lush is a cosmetic store specializing in the retail of bath bombs, hair products, makeup and more. | |
| Leak Size | 110GB |
Credential Exposure for lush.com
We've indexed 339 @lush.com accounts from external breaches, plus 1,825 credentials for lush.com itself.
Last checked Aug 23, 2026
| @lush.com addresses from external breaches | |
|---|---|
| Third-party breaches | 257 accounts · across 77 breaches · 222 with a plaintext password · most recent Dec 18, 2025 |
| Combo lists | 153 accounts · most recent Aug 20, 2026 |
| Phishing pages | 29 accounts · most recent Aug 13, 2026 |
| Passwords for lush.com accounts | |
|---|---|
| Infostealer logs | 957 logins · 797 infected devices · most recent Aug 8, 2026 |
| Combo lists | 905 logins · most recent Aug 23, 2026 |
Logins may belong to customers or to staff, and the data doesn't say which. None of this is necessarily connected to the ransomware attack above.
Is your organization next?
Lush was breached. Check if your company's credentials have been exposed in this or other data breaches.
Check your exposure →Continuous dark web monitoring alerts you when we find leaked credentials or session tokens for your company.