Heineken employee data offered for sale after 888 claimed a breach
- Organization
- Heineken
- Exploit
- Hacking
- Industry
- Food and Beverage
A threat actor operating under the handle 888 posted a listing on the BreachForums cybercrime forum in early June 2024 claiming to hold records for 8,174 employees of the Dutch brewer Heineken. The data was offered for sale behind the forum's paywall rather than held for ransom.
According to Cyber Daily and The Cyber Express, the seller described a set containing employee ID numbers, full names, email addresses and job roles, covering staff in a number of countries. To support the claim, 888 published a sample covering ten individuals in countries including Brazil, Nigeria, Indonesia and the United Kingdom. Cyber Daily noted that one of the sample records appeared to belong to a third-party organisation in the drinks supply chain rather than to Heineken itself.
Heineken issued no statement on the listing, and both outlets reported that the company had not responded to requests for comment. The claim was therefore never confirmed, and the ten-record sample was too small to establish the size or provenance of the full set.
888 was a prolific seller on BreachForums at the time and had attached its name to a series of claimed corporate breaches. Heineken had also been affected by a supply chain incident the previous year.