Intruder Steals Members' Mailing Addresses and Purchase Details from Collectors' Site Delcampe

Delcampe members learned the news by email: overnight between November 5 and 6, an unauthorized third party downloaded files containing some of their personal data. The site, published by the Belgian company Delcampe International, is a well-known marketplace for stamp, postcard and coin collectors. It claims more than one million active users in more than 190 countries.

Delcampe says it has blocked the access in question, secured the files and put additional measures in place. The incident does not affect all users, the company says, but it did not say how many accounts are involved. It states that it has found no account compromise. These details come from the message sent to members, as reported by the specialist sites Fuites Infos and Cyberattaque.org.

What the files contained

• the account ID and username;
• first and last name;
• the account language;
• the shipping address;
• for some members, details of certain purchases: items, dates and prices.

According to Delcampe, passwords, phone numbers, payment data and bank details are not affected. Neither are real email addresses, because the platform's messaging system uses intermediary addresses.

Why scammers want this data

A name, an address, a purchased item and its price: with this information, a scammer could write a very convincing fake message about an order, Cyberattaque.org points out. Delcampe is also warning its members about fraudulent messages that mention their purchases or deliveries. For a collector, the mailing address tied to an item that is sometimes valuable is also sensitive information in itself.

Many questions remain open. Delcampe has not said how the intruder got in, or who they are. It is not known whether the files are circulating or being offered for sale. The email also makes no mention of a notification to a data protection authority. Yet the GDPR requires, in principle, that a data breach be reported within 72 hours, unless it is unlikely to pose a risk to individuals. For a Belgian company, the competent authority is the Belgian Data Protection Authority.

What to do if you are a member

Delcampe believes no particular action is necessary. A few precautions cost nothing, however:

• be wary of any email or text message that mentions an order, a delivery or a seller, even if the details are accurate;
• never pay or log in from a link you receive: go directly through the site or the app;
• enable two-factor authentication if it is offered, and change your Delcampe password, then the password of any other service where it was reused, as Fuites Infos advises;
• report scam attempts. In France, the public service cybermalveillance.gouv.fr provides help and advice.

What happens next is up to Delcampe. The number of affected members and the origin of the intrusion will show whether the incident is as limited as the company suggests.