A hacker going by the alias 'Satanic' has claimed responsibility for a significant data breach affecting websites that rely on WooCommerce, a leading eCommerce platform.

The attack, allegedly carried out on 6 April 2025, reportedly compromised more than 4.4 million customer records containing personal and corporate data.

The stolen information includes email addresses, phone numbers, physical addresses, and social media profiles, as well as details about company revenues, staff sizes, and tech stacks.

Rather than breaching WooCommerce's own infrastructure, the attacker claims to have targeted systems integrated with WooCommerce sites-likely through vulnerabilities in third-party tools such as CRM or marketing automation software.

The announcement was made on Breach Forums, a known hub for cybercrime activity, where the hacker also indicated the stolen data is now up for sale via private messages or Telegram, with no fixed price.

Cyber Security News has verified samples of the exposed data, which include entries from major organisations. If confirmed, this would mark one of the largest data exposures linked to a WordPress-based commerce platform in 2025.

The incident follows previous breach claims by the same hacker involving other platforms like Magento and Twilio's SendGrid, the latter of which was denied by the company.

WooCommerce, owned by Automattic, currently powers over a third of all online shops globally. Its widespread use and integration flexibility have contributed to its popularity, but this breach highlights a growing security risk around third-party connections.

As of now, WooCommerce has not released a statement. Businesses using the platform are urged to audit their integrations and monitor for suspicious activity.