Zara Breach Exposed Data of 197,400 People, Have I Been Pwned Says
Summary
Have I Been Pwned says data from 197,400 people was exposed in the Zara breach. Inditex attributed unauthorized access to a former technology provider and said credentials and payment data were not exposed; ShinyHunters claimed responsibility.
Key points
- Inditex said unauthorized access involved databases hosted by a former technology provider; it has not named the provider or attributed the breach to a specific actor.
- Have I Been Pwned said its analysis found data relating to 197,400 people.
- The exposed data reportedly included email addresses, geographic locations, purchases, support tickets, product SKUs, and order IDs.
- Inditex said names, phone numbers, addresses, credentials, and payment data were not exposed, and its operations and systems were unaffected.
- ShinyHunters claimed responsibility and said it leaked a 140GB archive allegedly stolen from BigQuery instances using compromised Anodot authentication tokens.
Article Details
- Victim Organization
- Zara
- Incident Type
- Unauthorized access and data breach, with data theft reported
- Data Types Exposed
- Email addresses
- Geographic locations
- Purchases
- Support tickets
- Product SKUs
- Order IDs
- Market information
- Affected Records
- 197,400 people, according to Have I Been Pwned
- Affected Data Size
- ShinyHunters reportedly leaked a 140 GB archive of documents allegedly stolen from BigQuery instances; the archive's connection to the Zara breach was not confirmed by Inditex.
- Operational Impact
- Inditex said its operations and systems were unaffected.
- Ransom Or Extortion
- ShinyHunters claimed responsibility and reportedly leaked an archive. No Zara-specific ransom demand is reported.
- Claim Status
- claimed