Threat watch / Breach
Delcampe: collectors' addresses and purchases downloaded
The Belgian collectibles marketplace told some members by email that files holding their data were downloaded without authorisation on the night of November 5 to 6: names, delivery addresses and details of some purchases. It says passwords, real email addresses, phone numbers and payment data were not exposed.
- Sector
- Retail
- Way in
- Not public yet
- Product or vendor
- None named
- How it happened
- Not public yet Checked 8 Nov 2026
- What was stolen
- Account identifiers and usernames, first and last names, account language, delivery postal addresses, and details of some purchases (items, dates, prices). Delcampe says passwords, real email addresses (it uses relay addresses), phone numbers, payment and bank details were not exposed.[1][2][3] Checked 8 Nov 2026
- Who was impacted
- Part of Delcampe's members, not all of them. The number is not public.[1][2][3] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- Files holding member data are downloaded without authorisation during the night of November 5 to 6, according to Delcampe's email to members. [1][2][3]
- Delcampe emails affected members. It says no account compromise was found. French breach trackers report the email; none says whether the data was published or put up for sale. [1][2][3]