Zara Data of 197K Customers Exposed in ShinyHunters Ransomware Attack

A ransomware group known as ShinyHunters has exposed the data of approximately 197,000 Zara customers after compromising the fashion retailer through a former technology provider linked to Anodot and Snowflake. The incident, which Inditex confirmed in May 2026, involved the unauthorized access of BigQuery databases containing email addresses, purchase histories, order IDs, product SKUs, and support tickets. No names, physical addresses, passwords, or payment information were included in the exposed dataset, and the company stated that its core operations remained unaffected.

Public reporting indicates that ShinyHunters claimed responsibility for the breach, leaking records from Zara’s customer databases that originated via a third-party vendor. Industry research from sources such as DoxxScan™ continuous monitoring attributes the incident to the same actor group previously associated with other high-profile data leaks. Inditex, Zara’s parent company, acknowledged the exposure of roughly 197,400 unique email addresses alongside transactional details such as order identifiers and customer support correspondence. Available reporting describes the breach as occurring through compromised credentials or configurations tied to the former provider rather than a direct attack on Zara’s primary systems.