GoKawiilHackers who gained access to the databases of Spanish fast-fashion retailer Zara stole data belonging to more than 197,000 customers, according to data breach notification service Have I Been Pwned.
Zara has over 1,500 company-managed and franchised stores worldwide and is the flagship brand of the Inditex Group, one of the world's largest fashion distribution groups, which also owns Bershka, Zara Home, Oysho, Pull&Bear, Massimo Dutti, Stradivarius, and Uterqüe.
As Inditex stated last month, when the data breach was widely reported, the compromised databases were hosted by a former tech provider and contained information about business relationships with customers in different markets.
However, Inditex noted that the attackers didn't gain access to affected customers' names, phone numbers, addresses, credentials, or payment information (such as bank cards).
It also added that its operations and systems were unaffected, but has yet to attribute the breach to a specific threat actor and to share the name of the hacked provider.
"Inditex has immediately applied its security protocols and has started notifying the relevant authorities of this unauthorized access, that stems from a security incident that affected a former technology provider and has impacted several companies operating internationally," Inditex said.
While Inditex and Zara have yet to disclose more details regarding the incident, including the total number of affected individuals, the ShinyHunters extortion gang has since claimed responsibility for the breach and leaked a 140GB archive containing documents allegedly stolen from BigQuery instances using compromised Anodot authentication tokens.
Zara entry on ShinyHunters' data leak site (BleepingComputer)
Have I Been Pwned analyzed the stolen data and said today that the resulting data breach exposed the data of 197,400 people, including unique email addresses, geographic locations, purchases, and support tickets. "The data contained 197k unique email addresses alongside product SKUs, order IDs and the market the support ticket originated in," Have I Been Pwned said.
Previously, the cybercrime gang told BleepingComputer that they had stolen data from dozens of companies using Anodot authentication tokens, adding that they were blocked by AI-based detection when trying to steal data from Salesforce instances.
... continue reading