MyRecon OSINTAdvance Auto Parts
Behind the exposed accounts
In June 2024, Advance Auto Parts confirmed they had suffered a data breach which was posted for sale to a popular hacking forum.
Follow the story
On 5 June 2024, Advance Auto Parts was breached. 79,243,727 accounts were exposed, including email addresses, names, phone numbers. MyRecon rates it 74/100, severe. That is roughly everyone in the United Kingdom.
How the story unfolded
Open a step to read the detail. Missing dates stay unknown.
02Entry point
Linked to unauthorised access to Snowflake cloud services, the breach exposed a large number of records related to both customers and employees.
03Discovery and disclosure
A separate discovery or company-disclosure date is not established by this feed record.
04Added to the breach catalogue
2024-06-24. This is the catalogue date, not necessarily the disclosure date.
05Reported outcome
79,243,727 accounts are listed in this breach. This is a count of accounts, not necessarily individual people. The reported exposed data includes Email addresses, Names, Phone numbers, Physical addresses.
This belongs to a set rather than standing alone. Through mid-2024 a long run of large companies disclosed breaches traced to their own cloud data warehouse tenants, accounts reached with credentials stolen earlier by malware, on tenants where multi-factor authentication was not enforced. The platform itself was not compromised. The customers' configurations of it were.
It is the clearest illustration available of what shared responsibility means in practice. The provider secures the service; the customer secures access to their instance. Where that line sits is written in documentation nobody reads until a quarter of a billion records have moved, and in 2024 a great many organisations discovered which side of it they had been standing on.
The full case file covers how the campaign worked and why so many companies fell in the same few weeks.
The story behind the breach
In June 2024, Advance Auto Parts confirmed they had suffered a data breach which was posted for sale to a popular hacking forum. Linked to unauthorised access to Snowflake cloud services, the breach exposed a large number of records related to both customers and employees. In total, 79M unique email addresses were included in the breach, alongside names, phone numbers, addresses and further data attributes related to company employees.
Breach description from Have I Been Pwned, used under a CC BY 4.0 licence.
How did it happen?
Linked to unauthorised access to Snowflake cloud services, the breach exposed a large number of records related to both customers and employees.
What was the motive?
In June 2024, Advance Auto Parts confirmed they had suffered a data breach which was posted for sale to a popular hacking forum.
Reported demands or attempts to sell data describe what happened, rather than prove every attacker's intention.
What was the outcome?
79,243,727 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.
The reported exposed data includes Email addresses, Names, Phone numbers, Physical addresses.
What was exposed, and why it matters
Email addresses
The address becomes a confirmed, active target, expect more phishing, better aimed.
Names
Turns an anonymous address into an identified person, which is what makes targeted phishing possible.
Phone numbers
Enables SIM-swap attacks against SMS two-factor codes, and puts the number on scam-call lists indefinitely.
Physical addresses
Where someone actually lives. Combined with a name this moves the risk off the internet.
What to do if you were in it
Questions people ask about this breach
Was my email address in the Advance Auto Parts breach?
Use the email box on this page. The result applies only to this incident. If the provider does not cover this breach, we say so. A missing match does not prove you were unaffected.
What data was leaked in the Advance Auto Parts breach?
email addresses, names, phone numbers, physical addresses. Each one is explained above, along with what it means for the person it belongs to.
When did it happen, and when did it become public?
The breach is dated 5 June 2024. It was published to Have I Been Pwned on 24 June 2024, a gap of 19 days during which the data was already out.
Is the Advance Auto Parts breach real?
Yes. Have I Been Pwned lists it as verified, meaning the data was checked against the source rather than taken on trust.
How many people were affected?
79,243,727 accounts. That is roughly everyone in the United Kingdom. That is accounts rather than people, one person often has several.
Read next
Also in the archive
Case Files: how the landmark breaches actually happened →
Three kinds of content appear on this page and they are kept apart deliberately. The breach description is quoted from Have I Been Pwned under its licence. The severity score, the field-by-field explanation and the advice are computed from the record itself, every sentence derives from a number or a flag in it, which is what stops the analysis drifting from the evidence. Anything under the "MyRecon's take" byline is editorial: our reading of this breach, presented as opinion rather than as a finding.