Breaches and incidentsBriefReported by a reputable outlet, citing the company
Zara (Inditex): 197,000 customers’ support-ticket and order data from a third-party-hosted database
Inditex confirmed unauthorized access to databases hosted by a third-party technology provider (not named) in April 2026.
- Disclosed
What happened
- Inditex confirmed unauthorized access to databases hosted by a third-party technology provider (not named) in April 2026. HIBP (added 8 May): 197.4k emails with locations, purchases, order IDs, SKUs and support tickets. Inditex says names, phone numbers, addresses, passwords and payment data were not accessed.
- Root cause: third-party provider compromise; ShinyHunters says it came via the Anodot analytics platform (see the Anodot entry). Inditex has not confirmed.
- ShinyHunters claimed it and published about 1TB / 140GB (figures vary).
- Customers notified.
Sources
- https://haveibeenpwned.com/Breach/Zara
- https://bleepingcomputer.com/news/security/zara-data-breach-exposed-personal-information-of-197-000-people
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.