Zara data breach: 197K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-05-08
In April 2026, the fashion brand Zara was among a number of organisations targeted by the ShinyHunters extortion group as part of their "pay or leak" campaign. The group claimed the breach was related to a compromise of the Anodot analytics platform and subsequently published a terabyte of data allegedly including 95M support ticket records. The data contained 197k unique email addresses alongside product SKUs, order IDs and the market the support ticket originated in. Zara's parent company Inditex advised that the incident didn't affect passwords or payment information. Exposed data: email addresses, geographic locations, purchases, support tickets. The breach dates from Apr 15, 2026; Have I Been Pwned loaded it on May 8, 2026.
What to do
- If you had a Zara account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch