evap.ma Customer Login Data Leaked

Overview

On 20 August 2025, a DarkForums user shared data described as 100 customer login records from evap.ma, a Casablanca-based e-cigarette retailer operating two stores (Maarif and Beaulieu).

What was published

The post provides a downloadable file with customer login data:

• Name, username and email
• Password (described as encrypted but noted as usable)

The poster also claims the file includes the login information of the site administrator.

Risks for affected individuals

• Login data enables account takeover if passwords are reused.
• Admin credentials, if valid, could expose the entire platform.
• Email addresses enable targeted phishing.

What remains unknown

• The number of customers affected beyond the 100 records.
• Whether the administrator account was actually compromised.
• The company's response.

What affected people should do

Customers of evap.ma should change their passwords immediately, especially if reused elsewhere, and monitor their accounts for unauthorized activity.