Halara

Halara is an organisation headquartered in Hong Kong and known by the same alias. In January 2024 it became the subject of a security investigation after a data breach was discovered on its website. The breach exposed nearly 950,000 customer records, representing a substantial volume of personal information held by the entity.

The incident stemmed from an unfixed application programming interface vulnerability that was exploited by an external actor. Exposed data included names, phone numbers, addresses and geographic details, with the accuracy of the information confirmed through victim verification. The compromised dataset was subsequently made public by the threat actor on both a hacking forum and a Telegram channel.

The hacker responsible for the leak operates under the moniker ‘Sanggiero’ and stated that the low resale value of the data motivated the public release. By publishing the information openly, the actor enabled widespread accessibility to the personal details of almost one million individuals.

The breach has heightened the risk of smishing attacks and potential fraud, as the stolen records could be used to craft targeted phishing messages or facilitate unauthorized purchases. Observers have noted that the tactics employed mirror those seen in other retail sector incidents, although Halara’s specific market focus is not detailed in the source material. The organisation continues to investigate the scope and origin of the leak while assessing the broader implications for its customers and security posture.