Breachesby GlyphExpress
Disclosed Apr 16, 2026Unverified
Express order page flaw exposed customer contact and order details
A flaw in Express order confirmation pages let anyone cycle through sequential order numbers to view customers' names, contact and delivery details, purchases and card type with last four digits. Express fixed the bug after TechCrunch reported it.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Apr 16, 2026 |
| Attack | Exposed data |
| Data exposed | NamesPhone numbersEmailsAddressesPayment cardsOther |
| Sector | Retail · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
Notices filed
History of this record
First recordedby seedSource
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.