Avery Products

Disclosed Jan 10, 202561,193 affectedConfirmed

Card skimmer on Avery website steals customers' payment data

Avery found that attackers planted a card skimmer on avery.com that captured payment details entered between July 18 and December 9, 2024; it reported 61,193 affected customers to Maine's attorney general.

What is known

People affected	61,193 (as reported by the organization)
Disclosed	Jan 10, 2025
Discovered	Dec 9, 2024
Happened	Jul 19, 2024
Attack	Hacking
Data exposed	NamesCredentials and tokensAddressesEmailsPhone numbersPayment cards
Sector	Retail · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Avery Products

Official noticeatg.wa.gov

Washington Attorney General breach notice: Avery Products

Official noticeattorneygeneral.delaware.gov

Notice letter filed with the Delaware DOJ: Avery Products

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Avery Products

Newsbleepingcomputer.com

Label giant Avery says website hacked to steal credit cards

Official noticeago.vermont.gov

Vermont Attorney General: 2025-01-29 Avery Products Corporation Data Breach Notice to Consumers

Official noticein.gov

Indiana Attorney General 2025 data breach report: Avery Products

Notices filed

Residents of WAJan 10, 2025

Washington AG1,724 people

Residents of DEJan 15, 2025

Delaware DOJ205 people

TotalJan 15, 2025

Research61,193 people

Residents of CAJan 16, 2025

California AGCount not stated

Residents of ORJan 16, 2025

Oregon DOJ61,100 people

Residents of INJan 16, 2025

Indiana AG1,195 people

Residents of VTJan 29, 2025

Vermont AGCount not stated

Residents of CAFeb 11, 2025

California AGCount not stated

History of this record

source2026-09-25

empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2025.pdfby backfillSource

source2026-09-25

empty to https://ago.vermont.gov/document/2025-01-29-avery-products-corporation-data-breach-notice-consumersby backfillSource

sector2026-09-25

other to retailby seedSource

attack2026-09-25

ransomware to hackingby seedSource

data_types2026-09-25

["names","credentials"] to ["names","credentials","addresses","emails","phone","payment-card"]by seedSource

summary2026-09-25

empty to Avery found that attackers planted a card skimmer on avery.com that captured payment details entered between July 18 and December 9, 2024; it reported 61,193 affected customers to Maine's attorney general.by seedSource

title2026-09-25

empty to Card skimmer on Avery website steals customers' payment databy seedSource

data_types2026-09-25

[] to ["names","credentials"]by backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 61193by backfillSource

attack2026-09-25

unknown to ransomwareby backfillSource

disclosed2026-09-25

2025-01-16 to 2025-01-10by backfillSource

discovered2026-09-25

empty to 2024-12-09by backfillSource

disclosed2026-09-25

2025-02-11 to 2025-01-16by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Avery Products