A database allegedly containing information from the official NAVI store has appeared on a hacker forum. The file contains nearly 60,000 order records spanning six years, including email addresses, phone numbers, and purchase information. However, the origin of the database and whether NAVI’s systems were actually compromised have not yet been independently confirmed.
Nearly 60,000 orders in the file
The post appeared on October 18 under the title Navi.gg 50k 2026. Its author, Sphere, claims that the data originated from Navi.gg and that the alleged breach was carried out by a user named Chucky back in August 2026.
An analysis of the published CSV file identified 59,848 rows, each with a unique order identifier. However, this does not mean that the leak affected nearly 60,000 different people, as a single customer could have placed multiple orders.
What data may have been exposed
The database contains 33 columns of personal, commercial, and technical information. Email addresses appear in 56,301 records, with 37,490 unique addresses identified, while phone numbers are present in 58,350 rows, including 39,779 unique values.
The file also contains order IDs and dates, order statuses, purchase amounts, discounts, promotional codes, payment methods, countries, cities, and delivery information. The records cover the period from September 25, 2020, to August 26, 2026.
No complete bank card details were found
The analysis of the database reportedly did not reveal complete bank card numbers or customer account passwords. The file contains information about the payment systems used, including PayPal, LiqPay, and Zen.com, but not complete card details.
The records also include 31,822 completed orders, 26,420 new orders, and 1,564 returned orders. Due to repeat purchases and duplicated contact information, it is impossible to determine the exact number of potentially affected individuals from this file alone.
The hacker cited a Metabase vulnerability
The author of the post claims that CVE-2026-72898, a vulnerability in Metabase, software used for database management and analytics, may have been exploited to obtain the information. In theory, compromising such a service could provide access to internal commercial information.
However, the CSV file itself does not prove that this particular vulnerability was exploited against systems associated with NAVI. The file reveals the structure of the obtained data but does not provide evidence of the intrusion method or identify which infrastructure may have been compromised.
The main risk is targeted phishing
Even without passwords or complete banking details, such a database could pose a threat to customers. Combining an email address, phone number, and information about a real order allows attackers to create significantly more convincing phishing messages.
Attackers could disguise these messages as delivery notifications, refund updates, or payment problem alerts. Therefore, users who have made purchases from the NAVI store should be particularly cautious about unexpected emails and messages and avoid entering payment information after following suspicious links.
The origin of the database still needs confirmation
At this point, it is only possible to confirm the existence of a file containing 59,848 structured records that appear to represent order information from 2020–2026. The authenticity of the entire database, its exact origin, and the circumstances surrounding its acquisition remain unverified.
There is also currently no evidence that NAVI’s core infrastructure itself was compromised. In theory, the source of the leak could have been a separate store service or a third-party technical contractor, so definitive conclusions can only be drawn after further verification or an official statement from the organization.
