Zara: ‘Exercise the utmost caution’: Zara warns customers after possible data breach

Zara Alerts Customers to Data Breach Involving Third-Party Provider

On December 18, 2023, global fashion retailer Zara notified customers of a potential data breach affecting information hosted by a third-party service provider. The unauthorized access, detected on April 14, may have exposed browsing activity, purchase history, internal or device identifiers, customer service queries, and some contact details.

In an email to customers, Zara stated that the breach did not compromise passwords, payment details, or other sensitive financial data. The company emphasized that the incident posed "no relevant risk to customer privacy" and assured users that their accounts remained secure. Zara also reported the incident to authorities and advised customers to remain cautious of suspicious communications.

While Zara’s customer service confirmed that no personal information was compromised, the company issued a precautionary warning, urging users to avoid clicking on untrusted links or attachments. The breach highlights ongoing risks associated with third-party data handling in retail cybersecurity.

Source: https://www.bnnbloomberg.ca/business/company-news/2026/05/30/zara-emails-customers-about-possible-breach-of-information/

Zara TPRM report: https://www.rankiteo.com/company/zara

"id": "zar1780187075",
"linkid": "zara",
"type": "Breach",
"date": "5/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Fashion/Retail',
                        'location': 'Global',
                        'name': 'Zara',
                        'type': 'Retailer'}],
 'attack_vector': 'Third-Party Provider Compromise',
 'customer_advisories': 'Precautionary warning to avoid suspicious '
                        'communications and untrusted links/attachments.',
 'data_breach': {'personally_identifiable_information': 'Contact details',
                 'sensitivity_of_data': 'Low to Moderate',
                 'type_of_data_compromised': ['Browsing activity',
                                              'Purchase history',
                                              'Internal/device identifiers',
                                              'Customer service queries',
                                              'Contact details']},
 'date_detected': '2023-04-14',
 'date_publicly_disclosed': '2023-12-18',
 'description': 'Global fashion retailer Zara notified customers of a '
                'potential data breach affecting information hosted by a '
                'third-party service provider. The unauthorized access may '
                'have exposed browsing activity, purchase history, internal or '
                'device identifiers, customer service queries, and some '
                'contact details. The breach did not compromise passwords, '
                'payment details, or other sensitive financial data.',
 'impact': {'data_compromised': 'Browsing activity, purchase history, '
                                'internal/device identifiers, customer service '
                                'queries, contact details',
            'payment_information_risk': 'None'},
 'post_incident_analysis': {'root_causes': 'Third-party service provider '
                                           'compromise'},
 'recommendations': 'Customers advised to remain cautious of suspicious '
                    'communications and avoid clicking on untrusted links or '
                    'attachments.',
 'references': [{'source': 'Zara Customer Notification'}],
 'regulatory_compliance': {'regulatory_notifications': 'Yes'},
 'response': {'communication_strategy': 'Customer email notification, '
                                        'precautionary warning',
              'law_enforcement_notified': 'Yes'},
 'title': 'Zara Data Breach Involving Third-Party Provider',
 'type': 'Data Breach'}