Mindfactory has reset every customer password after a cyberattack. Anyone with an account at the hardware retailer has to change it before the shop is usable again.
The company, based in Wilhelmshaven, says it has notified customers and the data protection authority and filed a criminal complaint against unknown parties. Those notified are everyone who has ordered since the heise group took over the business in July 2025.
On current information Mindfactory cannot rule out that attackers had access to personal data: postal address, email address, telephone number and encrypted passwords. Bank and credit card details can be excluded, the company says, because they are not stored in the shop system but with the payment providers. Mindfactory believes those were what the attackers were after.
New passwords will use a more modern hashing scheme, according to managing director Marcel Kirchner. The investigation continues.
The practical consequence reaches beyond the shop. Because contact data may be affected, Mindfactory is warning of targeted fraud by email, SMS or phone call and advising customers not to give out personal information or open links and attachments. Anyone who reused a Mindfactory password elsewhere should change it there too — a stolen hash is not plaintext, but given enough compute and a weak password it is a start.
Disclosure: heise mindfactory GmbH is a subsidiary of the heise group, which also owns heise medien, the publisher of this report.
