Short answer
Mindfactory told customers on 6 November 2026 that its systems were hacked and that it cannot rule out access to addresses, email addresses, phone numbers and encrypted passwords. The retailer says there is no sign plaintext passwords or payment data were involved. It reset all shop passwords and notified the data protection authority and police.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Mindfactory |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Online retail (computer hardware) |
| Country | Germany |
| Disclosed | 2026-11-06 |
| People or records affected | Not stated. Customers with accounts in the shop system |
What data was exposed
- Postal addresses (cannot be ruled out)
- Email addresses (cannot be ruled out)
- Phone numbers (cannot be ruled out)
- Passwords stored in encrypted form (cannot be ruled out)
What happened
On 6 November 2026 Mindfactory, a German online retailer of PC hardware, emailed account holders under the subject “Wichtige Information zum Schutz deiner persönlichen Daten”. ComputerBase quoted the company: “Wir haben festgestellt, dass es zu einem Hackerangriff auf unsere Systeme gekommen ist.” That is, the company found that a hacker attack had hit its systems.
stadt-bremerhaven.de published the same wording the same day.
What may have been accessed
Mindfactory says it cannot rule out that attackers accessed postal addresses, email addresses and phone numbers. It also cannot rule out access to stored passwords, which it says were held in encrypted form. The company states there are currently no indications that plaintext passwords were affected, and that bank and credit card data is not kept in the shop system because payment providers hold it.
The email does not say when the intrusion happened, how it was carried out or how many customers are involved. The investigation is ongoing.
What the company did
Mindfactory reset the existing shop passwords on its servers. Customers now receive a temporary password by email, log in with it and then choose a new one under “Mein Konto”. The company says it started measures to secure its systems, reported the incident to the state data protection authority and filed a criminal complaint with the police.
Why contact details alone are useful to scammers
A real name, a real address and a phone number from a known electronics shop are enough for a convincing fake. Expect messages about a “failed payment”, an “order you did not place” or a “security check of your account”. Our guides on online shopping scams and phishing messages show the common patterns. Because the real incident involves a password reset email, a fake reset email is an easy trick. Only act on a message you triggered, or go to the shop by typing its address yourself.
The notification gap
A commenter under the stadt-bremerhaven.de article said they never received the email. The author answered that, after Mindfactory’s restructuring, the shop required new accounts, so only holders of new accounts were notified. We could not confirm that explanation with the company. If you ordered in the past, assume you may be in scope and follow the steps above. Our guide on what to do after a data breach lists the basics.
What is still unknown
The date, the number of customers and the entry route are not public. See our other breach reports, including the notebooksbilliger.de incident from the same period.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails and SMS that use your name and Mindfactory order history to ask you to confirm an account or payment.
- Fake 'password reset' emails that send you to a lookalike login page after the real reset.
- Phone calls from people claiming to be Mindfactory or your bank who already know your address.
- Credential stuffing, where attackers try a leaked password on other shops, email and banking accounts.
What to do if you are affected
- 01Set a new Mindfactory password only through the temporary-password email you requested yourself, or by typing the shop address into your browser.
- 02If you used the same password anywhere else, change it there now. Use a unique password for every shop and turn on two-step login where offered.
- 03Treat unexpected emails, texts or calls that mention Mindfactory or ask for personal details as suspect. Do not open links or attachments in them.
- 04Look through your bank and card statements anyway. Mindfactory says payment data sits with its payment providers, but a check costs little.
- 05For questions, use the contacts Mindfactory gave: info@mindfactory.de or Datenschutz@mindfactory.de.
Frequently asked questions
Was my Mindfactory password stolen?
Mindfactory says passwords were stored in encrypted form and that there is currently no indication of plaintext passwords being affected. It cannot rule out access to the encrypted values, so it reset every password.
Was my card or bank data exposed?
The company says it excludes access to bank or credit card data because that is held by its payment providers, not the shop system. This is the company's statement and the investigation is still running.
When did the attack happen and how many customers are affected?
Neither is stated in the customer email as reported. ComputerBase and stadt-bremerhaven.de both say the company is still investigating what was taken.
I never got the email. Am I safe?
Not necessarily. A commenter under the stadt-bremerhaven.de report said they received nothing. The author replied that after the company's restructuring only people with new accounts were notified. That is an unconfirmed explanation, so if you have ever ordered, change your password and watch for phishing.
Is this linked to the notebooksbilliger.de attack?
Some forum comments and reports mention both incidents together, and ComputerBase notes the notebooksbilliger.de warning came shortly before. No source we read confirms a link between them.
Sources
- Hackerangriff: Mindfactory informiert über möglichen Datendiebstahl (Hacker attack: Mindfactory reports possible data theft), ComputerBase, 2026-11-06
- Sicherheitsvorfall bei Mindfactory: Möglicherweise wurden Kundendaten gestohlen (Security incident at Mindfactory: customer data may have been stolen), stadt-bremerhaven.de, 2026-11-06
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.