Fashion retailer Mango discloses data breach, exposing personal information of customers

Spanish fashion retailer Mango has acknowledged that an unauthorized party managed to access personal information of customers.

According to a notification letter that was sent to affected customers, the exposed information is limited to first names (no surnames), countries of origin, zip codes, email addresses, and telephone numbers.

Sensitive information like banking account numbers, credit card numbers, copies of IDs or passports, and login credentials haven’t been compromised.

The threat actor was able to exfiltrate this data via one of Mango’s external marketing service providers. The fashion retailer’s infrastructure and corporate systems continue to function normally.

“As soon as we became aware of this situation, Mango immediately activated all relevant security protocols. In accordance with current regulations and following our internal policies, Mango has informed the Spanish Data Protection Agency (AEPD) and other relevant authorities,” the company says in a statement.

The Spanish fashion retailer is recommending that affected customers remain vigilant and be aware of any suspicious messages or requests for actions received via email or phone.

How many customers have been affected by the data breach remains unclear. The same goes for when the incident took place.

At this time, no ransomware operation has claimed responsibility for the incident.

This is yet another incident among fashion retailers this year. Luxury department store Harrods, luxury retail company Louis Vuitton, parent company of several luxury fashion brands Kering, German sportswear brand Adidas, and French luxury fashion brand Dior have all fallen victim to hackers earlier this year.