Zara data breach exposes info of 197K customers
ShinyHunters claimed responsibility for a breach at Spanish fast-fashion retailer Zara (Inditex). Data from a former tech provider's databases was accessed using compromised Anodot tokens and later analyzed by HIBP. Exposed records include unique emails, geographic locations, purchases, order IDs, and support tickets.
- email-addresses
- purchases
- order-ids
- support-tickets
- geographic-locations
Spanish fast-fashion retailer Zara disclosed a data breach that exposed the personal information of approximately 197,400 customers after attackers compromised credentials belonging to a former technology provider.
According to public reporting, the threat actor group ShinyHunters gained access to databases maintained by a third-party tech vendor previously used by Zara, part of the Inditex group. The intruders used stolen Anodot monitoring platform tokens to exfiltrate records containing unique email addresses, geographic location data, purchase histories, order identifiers, and support ticket details. The compromised data was subsequently analyzed and hosted by Have I Been Pwned, allowing affected individuals to check whether their information appeared in the set. Zara has not publicly detailed the exact timeline of the intrusion, but available reporting indicates the breach originated from the former provider’s environment rather than Zara’s core production systems.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary Warden™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15.4B+ leaked records in 15 seconds — then show you the $19 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →