Live Auctioneers, Promo and others fall victim of data leaks.

A total of 9 breach events were found and analysed resulting in 4,621,343 exposed accounts containing a total of 6 different data types of personal datum . The breaches found publicly and freely available included Live Auctioneers, Promo, Unico Compania, Scentbird and NASA. Sign in to view the full library of breach events which includes, where available, reference articles relating to each breach.

Data Breach Analysis

The breached entities span a remarkably broad spectrum, from an auction platform and a fragrance subscription service to a U.S. government agency. Specifically included in this leak cluster are Live Auctioneers, Promo, Unico Compania, Scentbird, and even NASA, along with several others.

This group of breaches reflects not just the diversity of platforms vulnerable to exposure, but also the unpredictability of where leaked data ends up, and how long it remains in circulation. The total number of affected users is relatively moderate compared to other large-scale events, but the inclusion of high-trust organisations and niche businesses raises the profile of this breach set significantly. It is also worth noting the continued emergence of breaches where data is made freely available, removing any cost barrier for malicious actors.

Live Auctioneers is a major online platform for live and timed bidding on fine art, antiques, jewellery, collectibles, and estate items. With over a million listings and a dedicated global user base, the platform holds not just personal accounts but also financial behaviour profiles tied to high-value purchases.

Buyers of collectibles and art are often affluent, and scammers may impersonate auction houses, issue fake invoices, or craft phishing campaigns that appear to be updates about high-ticket items. Also, the nature of auctions means the stakes are financial, and sometimes emotional, leading to more impulsive, risk-tolerant behaviour that attackers can exploit.

Promo (formerly Promo by Slidely) is a video creation and marketing platform aimed at small businesses and marketing professionals. Users typically include social media managers, entrepreneurs, content creators, and startups looking to create promotional material at scale.

Promo accounts might not always contain deeply personal information, but the professional implications are considerable. If an attacker gains access to a user’s Promo account, they may be able to:
- Impersonate a brand or business
- Access stored content or drafts
- Disrupt scheduled promotional campaigns

Additionally, marketing professionals often reuse credentials across multiple SaaS platforms. A leak of even basic credentials here could open doors to email marketing platforms, ad accounts, or design tools, creating opportunities for digital sabotage or surveillance.

Unico Compania appears to be a regional or industry-specific entity, possibly based in Latin America or Southern Europe, although definitive public information is scarce. This suggests either a small or medium-sized enterprise, which typically operate with limited cybersecurity budgets and may rely on legacy platforms or unpatched open-source tools.

The risks of such breaches lie in:
- Reuse of credentials across unrelated services
- Minimal user awareness of the breach (no public disclosure)
- Lack of international visibility, despite data being globally available

Smaller entities are also more likely to be stepping stones in larger attack chains, where attackers first compromise a “low-value” platform to harvest valid credentials, then use those for lateral movement into higher-value targets.

Scentbird is a fragrance subscription service that delivers monthly samples of perfumes and colognes to users. Though seemingly innocuous, lifestyle subscription services often require personal information that gives attackers a rich dataset for both identity profiling and targeted fraud. A Scentbird user may also be a customer of other lifestyle brands, which can be inferred through shared data patterns. Subscription services are particularly vulnerable to impersonation fraud, fake emails about "delivery issues," for instance and leaked data allows for timing-specific scams ("Your subscription will expire in 3 days...").

The trust factor is also important. Users of such services often perceive them as niche and community-driven, so a breach can lead to significant brand damage even if the raw number of affected users is small.

The inclusion of NASA in this breach group raises immediate concern, not just due to the agency’s high profile, but due to the potential classification of the data involved. NASA has experienced several breaches over the years, often the result of phishing attacks or unsecured contractor endpoints.

In this instance, the publicly available data is believed to stem from lower-risk categories. Still, even seemingly trivial information related to a federal agency has potential implications:
- Leaked internal emails or usernames can aid phishing campaigns
- Credentials might be reused on other .gov or defence-adjacent systems
- Even symbolic breaches can be used in disinformation or propaganda

While the affected NASA data here is likely non-sensitive, the visibility of the agency ensures that any exposure amplifies reputational and geopolitical risks.

Six Data Types: Multi-Angle Threat Surface

Although the exact six data types have not been specified, the variety allows for layered attack strategies, from basic credential stuffing to precision-targeted spear phishing. It also enables identity stitching, where attackers connect a user’s presence across multiple platforms using shared or inferred data points.

The relatively modest number of accounts (4.6 million) may seem minor in an age of billion-row leaks, but context and diversity of exposure matter more than raw volume in many modern cybercrime tactics.

Conclusion

This collection of nine breaches, touching everything from fine art auctions and fragrance subscriptions to federal space agency accounts, speaks to the pervasiveness and unpredictability of digital exposure. The inclusion of well-known platforms alongside lesser-known businesses increases the risk that users may not even realise they were compromised. The broad spread of six data types and the public availability of the data ensure that these accounts will remain vulnerable long after the initial breach window has closed.

Whether it's a high-spending collector, a lifestyle subscriber, or a federal contractor, the fallout from these breaches extends far beyond the numbers.