Hackers Claim to Sell Stolen Data from Lazeo[.]com

A threat actor operating on the revived BreachForums dark web marketplace has listed a database allegedly containing 333,507 customer records from Lazeo, a prominent French aesthetic medicine provider specializing in non-invasive treatments like laser hair removal and medical-grade facials.

The dataset, priced at $200, reportedly includes full names, phone numbers, email addresses, birth dates, and home addresses.

This incident highlights persistent cybersecurity vulnerabilities in healthcare-adjacent industries handling sensitive personal data.

Alleged Data Sale and Technical Vulnerabilities

According to the post from ThreatMon, the advertised database purportedly stems from a breach of Lazeo[.]com, which operates 135 clinics across France, Belgium, and Germany after its 2023 acquisition of Munich-based Cleanskin.

While the exact infiltration method remains unconfirmed, the sale aligns with common attack vectors for healthcare data:

• SQL database exposure: The structured nature of patient records in systems like MySQL – cited in a similar 2021 incident involving 85,000 databases – makes them high-value targets.
• Insufficient access controls: Dark web forums like Exploit and BreachForums frequently trade credentials obtained via phishing or brute-force attacks.
• Lack of encryption: Unencrypted customer data enables threat actors to monetize information immediately upon exfiltration, bypassing decryption barriers.

The seller’s use of a .onion domain (requiring TOR browser access) and escrow payment systems mirrors transactional patterns observed in ShinyHunters-affiliated breaches, where threat actors netted $1,000 daily via managed sales platforms.

Lazeo’s rapid international expansion – supported by Blackstone’s investment – may have outpaced security infrastructure upgrades, creating exploitable gaps.

Regulatory Implications and Consumer Risks

Under the EU’s General Data Protection Regulation (GDPR), Lazeo faces potential fines of up to 4% of global revenue for failing to safeguard personal data.

The breach exposes customers to:

• Identity theft: Birth dates and physical addresses enable synthetic identity fraud, particularly when combined with leaked financial data from other breaches.
• Targeted phishing: Attackers could craft hyper-personalized emails referencing specific treatments or clinic locations.
• Medical privacy violations: While not explicitly stated, aesthetic service histories might be inferred from appointment-linked metadata.

Cybersecurity experts emphasize post-breach protocols like real-time transaction monitoring and dark web credential scanning for affected users.

However, Lazeo has not yet issued public statements or confirmed the breach’s legitimacy – a critical lapse given GDPR’s 72-hour notification mandate.

Proactive measures such as role-based access controls and end-to-end encryption could mitigate future incidents, but legacy systems in acquired entities like Cleanskin often lag behind corporate security standards.

With dark web forums now hosting over 15 billion records, the incident underscores the scalability challenges of securing distributed healthcare networks against increasingly organized cybercrime syndicates.

Also Read: