What the claimed Kakobuy data leak actually contains.

A shipping agent is an unusual kind of company to hand your details to.

A shop knows what you bought. A courier knows where you live. An agent is both, on purpose, for years — because the whole job is to receive your parcels under their address and forward them under yours.

So the file builds up. Your legal name, because customs wants it. Your street, because somebody has to knock. Your phone, because the last mile texts you. What you ordered and what you paid. And, if you ever took one of those share-to-earn deals, the handle of the account you posted the haul from.

One company holding all of that is fine right up until the moment it is not.

Since late August a site at kakobuyhack.com has been publishing what it says is data taken from Kakobuy. Its own inventory labels the source staff_user_scrape. That is where the word “staff” comes from; it is the attacker’s label, not a term Kakobuy has confirmed. The author writes as a cat called Ginger. The tone is jokey. The material is not.

A ransom note is not evidence. It is an advertisement written by somebody with an obvious reason to exaggerate. So we ignored the prose and went looking for the parts of the site a stranger can check.

There turn out to be quite a few.

The counters on that page are not decorations. They are fed by two JSON files sitting in the open next to the HTML, and those files are far more specific than anything in the write-up.

“6.2 million” is the number on the poster, and it is the number every video repeated. It is also the least useful figure in the file.

Rows are not people. Look at what the rows actually are, from his own surfaces[] list:

Five of the six million rows are logs. A points ledger with 1.2 million lines. An affiliate-code table with a million. A record of every marketing email sent. One person generates dozens of those rows without doing anything unusual.

The honest headcount is in the identifier counts, and it is smaller and much more concrete:

566,867 unique email addresses. 686,669 unique phone numbers. 991,388 address rows across 854,150 distinct user IDs.

So: not six million victims. On the order of half a million to eight hundred thousand real people, most of them with a home address attached. That is smaller than the poster and worse than a password dump, and we would rather print the number that survives arithmetic than the one that trends.

One more figure argues against the attacker’s completeness claim: the users table holds 92,096 rows, while the address table references 854,150 distinct user IDs. Those do not reconcile. Whatever he took, he did not take all of it evenly — which is also the first clue about how he took it.

Read that middle column again.

The filenames are consistent with saved internal web pages rather than a direct database dump. Together with the attacker’s own staff_user_scrape label, that supports an internal-interface scrape. It does not prove what Kakobuy called that interface or how access was obtained.

That interpretation also explains the mismatch. A direct users-table export would normally give one coherent population. A paginated scrape can stop partway through one section while collecting more rows from another, which is consistent with 92,096 users sitting next to 854,150 user IDs in the address export.

The evidence supports a claimed scrape of internal pages. It does not independently establish the attacker’s full story.

We cannot tell you how the door opened — stolen staff credentials, an admin route reachable without them, a contractor account nobody closed. The file does not say and we are not going to guess. What the file does establish is the shape: sustained authenticated-looking access to internal screens, not a leaked backup.

The site offers a “check if you are in it” box. Those are usually theatre. This one is not, and the way it works is checkable without trusting anybody.

The page hashes what you type in your browser and asks the server only for a shard of an index, named after the first two characters of that hash:

Then we did the arithmetic he was hoping nobody would do. He claims 566,867 indexed emails across 256 shards. We pulled a single shard — hashes and the integer 1, no personal data in it — and counted.

He has published four sample “drops” — 5,000 accounts in total, with the street, city and region stamped over. Two questions decide how much the rest of his claim is worth, and both can be answered without reproducing a single record.

Is he recycling the same people to look busy? No. Across the four files there are 5,000 rows and 5,000 distinct email addresses — no duplicates, and no overlap between any two drops. Each one is fresh material.

Do the drops and the hash index describe the same haul? Yes. We hashed every address in the drops the way his own page does and looked each one up in his 256-shard index.

The drops also answer the question the row counts left open. Every one of the 5,000 accounts was registered in July or August 2026 — 3,330 in July, 1,670 in August, none earlier. And their user IDs span a range of 92,057, against a users table of 92,096 rows.

That is one row per consecutive ID, with almost no gaps.

So his users file is not a sample of Kakobuy’s customers. It is an unbroken block of the most recent ~92,000 registrations — which is exactly the shape you get when somebody opens an admin list sorted newest-first and pages until they stop. It explains the mismatch above: the address screens gave up far more of the customer base than the user screens did.

It also means the exposure is not evenly spread. For the account fields, the people most likely to be in this file are Kakobuy’s newest customers — the ones who signed up in the two months before the scrape.

One last thing worth knowing if you are looking at those drops yourself. The site presents the masking as a courtesy, and street, city and region genuinely are stamped. But across all 5,208 address rows in the four drops, the recipient name, the phone number and the postal code are untouched. In most countries a name plus a postcode is a household. The redaction is thinner than the word suggests.

From his published field list, cross-checked against the tables in the inventory:

There is a reason this is worse than the breaches people are used to shrugging off.

A leaked password is a problem you can end in ninety seconds. You change it. Done. Nothing in the list above can be changed in ninety seconds. Your legal name cannot be rotated. Your street cannot be rotated. The phone number that has been on every parcel you have ever received cannot be rotated without a genuinely miserable afternoon.

And the pieces compose. A referral code links to an email; an email links to a shipping profile; a shipping profile links to a door. His own aggregates count 403,479 share-reward rows tied to TikTok — which means for hundreds of thousands of accounts the file contains both a public handle and the private address behind it.

That join is the actual harm. Not the row count.

We will go further, because this is the part of the story that actually deserves the anger.

Extorting a company is one thing. Through August this site extorted the victims — individually, at ninety-nine dollars a head, on a countdown. It ran a page naming individual customers, with their real phone numbers, as punishment for saying the wrong thing about the breach online, and invited readers to call them.

Whatever Kakobuy did or did not do, the people on that page are not the ones who failed here.

That is why this post has no screenshots. We could not photograph that site without republishing somebody’s phone number, and cropping the evidence is precisely the thing our other post refuses to accept from anybody else. The JSON above is better evidence anyway. You can fetch the same URLs and diff them; you cannot do that with a JPEG.

The reason to write any of this down is that it is not an accident that keeps happening to one unlucky company.

The pattern is the same every time, and it is three steps long:

Deny it. Delete the questions. Concede a percentage.

Not one of these companies published a breach notice on its own front page. In each case customers found out from the attacker, from a screenshot, or from a stranger on TikTok. That is a disclosure practice, and it is the industry’s, not one firm’s.

They lost your data. They have not told you. They are not going to fix it for you. Everything below is work that fell to you because of that, and they are not the first — it went the same way at PandaBuy and at Sugargoo.

Assume the address is out. Not because we know your row is in the file, but because everything here is worth doing anyway and none of it costs money.

Change the password everywhere you reused it. Not on the agent — on the email account that agent knows about. Order confirmations make a very good target list.

Turn on two-factor authentication on that email. The file contains no passwords. It contains an enormous amount of material for talking somebody into a reset.

Expect the scam to be well-informed. The convincing version is not a stranger asking for your card. It is a text about a specific parcel, using your real name and your real order, from a number you have no reason to doubt. Treat any delivery message that wants a payment or a login as false, and go to the site yourself.

Search your address for yourself. Have I Been Pwned carries the PandaBuy set already, and it is free.

Use an address you can abandon. A parcel locker, a pickup point, a forwarding service. This is the only item on the list that actually solves the problem rather than mitigating it, and it is the one nobody wants to hear.

Three of the agents named above are rows on this scoreboard.

We have not added a security column, and we are not going to invent one this week. We would have to score companies on something we cannot measure from the outside, and a comparison that grades an unmeasurable thing is the failure mode this whole site exists to complain about. What we can do is what we just did: write down what is checkable, show our arithmetic, and archive the source so it survives the page coming down.

We are also a shipping agent. NinjaBuy holds the same kind of file on its own customers, and it would be worth exactly nothing for us to stand here and assure you it is safer. We have not been audited either. Nobody reading this should take a security claim from a company that is also selling shipping — including ours.

What we will say is the same thing we say about prices, which we also decline to publish for ourselves until we can stand behind them: the standard applies to us first.

If we ever lose your file, you will hear it from us, on this domain, before you hear it from a cat.

Nobody paid for this post. Nobody paid for the board. There are no affiliate links on this site — not to Kakobuy, not to the agents in a better position this week, not to us.