- ShinyHunters leaked 140GB of data from Zara’s BigQuery instances, exposing 197,400 emails, purchase records, and support tickets
- Inditex confirmed no names, addresses, credentials, or payment info were stolen, reducing direct risk
- Still, exposed emails and purchase details could fuel tailored phishing campaigns against customers
Fashion behemoth Zara lost customer data on almost 200,000 people, but it seems very little private information was actually stolen.
Zara is one of the biggest fashion retailers in the world, with more than 1,500 stores around the world, and is the flagship brand of the Inditex Group, which also owns Massimo Dutti, Pull&Bear, Bershka, and many others.
Last month, it disclosed suffering a data breach as the result of the ongoing incident involving Anodot, an AI-powered, cloud-based analytics platform that some companies integrated with other services, such as Snowflake. When ransomware actors ShinyHunters broke into Anodot, they were able to access those integrations and steal files belonging to multiple companies.
ShinyHunters strike again
When Inditex reported on the incident, it said the attackers did not access private information such as names, phone numbers, addresses, login credentials, or payment information.
"Inditex has immediately applied its security protocols and has started notifying the relevant authorities of this unauthorized access, that stems from a security incident that affected a former technology provider and has impacted several companies operating internationally," the company said at the time..
In the meantime, ShinyHunters claimed responsibility for the attack and leaked a 140GB archive which it claims to have stolen from BigQuery instances. Now, Via BleepingComputer reports Have I Been Pwned? analyzed the stolen data and found 197,400 email addresses, geographic locations, purchases, and support tickets.
"The data contained 197k unique email addresses alongside product SKUs, order IDs and the market the support ticket originated in," the service said.
While not having names and addresses reduces the risk somewhat, cybercriminals can still use the available information to run highly tailored phishing campaigns. Through these emails they can steal login credentials, deploy malware, and thus escalate the attacks further.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.