On 3 November 2026 a Telegram advertisement offered what its headline calls “182 Million customer profiles” from Neiman Marcus. The seller signs “SH”, and its contact line is built on the ShinyHunters name. The sale it describes is the seller’s claim only, and Brandefense has not verified any of it.
This explainer sets each claim next to what can be checked. We name no seller, channel or contact, link no listing and repeat no personal data. Where we judge how likely a claim is, we say “our reading”.
What Does the Advertisement Claim?
The post is headlined “180M Users, SSN + 3m Plaintext CC”. It says the data holds “Name, Address, Phone, DOB, Email, Last 4 of SSN, Last 4 of CC”. It adds “3 Million PLAINTEXT Credit Card Numbers”, “70M transactions” and “12M gift card numbers”. It also claims “50M customer emails and IP addresses tracking” and “6 billion rows” of shopping records, employee data and store information.
The seller says the company was given the chance to pay and declined. The text also calls the case another “Flake”, a reference we read as Snowflake, the cloud data platform. The advertised price is $50k.
- Post created.
- 3 November 2026, 12:05 UTC (Telegram).
- Claimed size.
- “182 Million customer profiles”.
- Claimed contents.
- Name, address, phone, birth date, email, last 4 of SSN, last 4 of card, 3 million card numbers, gift cards, employee data.
- Seller identity.
- Signs “SH”; the contact line uses the ShinyHunters name, which we cannot confirm.
- Advertised price.
- Stated once in the text above.
- Neiman Marcus statement on this claim.
- The one address we tried on 3 November 2026 did not load a page.
- Confirmation of the data.
- We have seen none, and we did not open or test any sample.
What Do Our Data and the Company’s Pages Show?
Brandefense Blackhole holds the advertisement as one post, created on 3 November 2026 at 12:05 UTC and first seen by us at 12:05, a few seconds after posting. The posts we pulled that day hold only that one copy of the text. A repost may still appear later.
In October and November 2026, 17 posts in our pull contain the words “Neiman Marcus”. Fourteen are gift card and fraud method service ads that list the retailer among many brands. One is a news digest of 1 November, one is a reply post of 3 November, and one is this advertisement.
Before 3 November, our pull holds no post that offers a Neiman Marcus database on its own. One post of 13 August names the retailer inside a long list of companies, headed by a price of its own; the 13:06 reply pastes the same list. Our reading: a name on such a list is a claim, not proof.
The reply post, created at 13:06 UTC in another chat, defends the seller and lists the retailer among companies it credits to the same account. Our reading: that is a supporter vouching for a seller, which is not evidence about the data.
We also looked at the company. The one address we tried on 3 November 2026 did not load a page. That is a weak check, and it says nothing about what the company has stated elsewhere.
Does 182 Million Customer Profiles Sound Plausible?
The advertisement’s “Flake” reference is a word we read as Snowflake. The text gives no earlier figure to set the 182 million against, and we have no company or regulator notice to compare it with.
Our reading: a seller can pick a size that sounds large without any link to the people a company actually notified. That is why a figure like this needs a notice to compare with.
- 182 million profilesOur reading: compare with any notice the company files; may count rows, duplicates or other sources; unverifiedWho can verify itNeiman Marcus
- Last 4 of SSN and last 4 of cardOur reading: partial values on their own limit direct misuse, but help impersonation; unverifiedWho can verify itNeiman Marcus
- 3 million plaintext card numbersOur reading: conflicts with the same text listing only last 4 digits of cards; unverifiedWho can verify itNeiman Marcus and card networksHardest to square
- 12 million gift card numbersGift cards are a common retail data type; we cannot match this figure to any notice; unverifiedWho can verify itNeiman Marcus
- 6 billion rowsOur reading: a row count, not a people count; unverifiedWho can verify itNeiman Marcus
Why Does the Card Claim Not Fit Together?
The advertisement says the profiles hold “Last 4 of CC” and, separately, “3 Million PLAINTEXT Credit Card Numbers”. Our reading is that both can be true only if two different tables exist. The text gives no way to tell, and a seller who wants to raise a price has reason to blur the two.
The size is the second question. 182 million is a count of profiles, and a retailer’s database can hold repeated people, guests, old accounts and test rows. Our reading is that a number that large, mixed with 6 billion rows, looks more like a combined set or a rounded headline than one clean list of customers.
Is Recycled Data Possible, and Is the Name Real?
Recycled data is a risk to weigh. Our reading: a seller may repackage data from other incidents or leaks and sell it as new, and the post gives no date for the data.
The ShinyHunters name is a separate question. In October 2026 many posts in our pull use the name with announcement or sale wording. Several are repeats, so the number of distinct offers is lower. Our reading: many posts use the name, and a name on a post is not proof of who wrote it.
For background on the group, read our profile of ShinyHunters and our piece on the Clop and ShinyHunters leak site. For how such listings are built, see our anatomy of a dark web listing.
What Should Customers and Retailers Do?
A claim can cause harm without being true. Our reading is that the likely effect is phishing that uses the “leak” as a pretext. Such a message says your card or account was exposed and asks you to click, call or confirm. Learn the basics in our entry on phishing, and see what such events involve in our entry on a data breach.
- Do not follow leak messagesOpen the retailer’s app or a typed address yourself. Treat any message, call or text about a leak as hostile until you confirm it there.
- Watch your cardsCheck statements and turn on transaction alerts. If your bank offers a card replacement, you can ask for one as a precaution.
- Check gift cardsIf you hold a store gift card, check its balance through the official channel and spend or replace it if you are unsure.
- Protect identityBe cautious with calls that quote the last digits of an SSN or card, because those partial values can make a scam sound real.
- Brief staff and customersRetail security teams can warn customers about leak-themed phishing and point them to one official contact.
- Wait for the sourceTreat the sale as unverified until the company or an independent party confirms it.
What Is Still Unknown?
We do not know whether real Neiman Marcus data sits behind the listing, how old it is, or whether the sample fields match any company system. The next useful facts would come from the company or from analysts who have examined a sample safely. We will update this article if a named party confirms or denies the claim.