Zara
Disclosed May 8, 20264 months ago197,376 accountsUnverified
Zara data stolen via Anodot tokens, 197,400 customers affected
Inditex confirmed a breach involving a former technology provider after ShinyHunters used Anodot authentication tokens to take data from BigQuery and leaked 140 GB. Have I Been Pwned counted 197,400 people with emails, locations, purchase and support data.
What is known
| People affected | 197,376 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | May 8, 2026 |
| Discovered | Apr 2026 |
| Happened | Apr 15, 2026 |
| Attack | Vendor breach |
| Data exposed | Emails, Location, Financial, Other, Messages |
| Sector | Retail · ES |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
| Part of | Anodot (2026) |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| Have I Been Pwned: Zarahaveibeenpwned.com · Aggregator | Aggregator |
| Zara data breach exposed personal information of 197,000 peoplebleepingcomputer.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Have I Been Pwnedaccounts in the data | May 8 | 197,376 |
| Researchtotal | May 8 |
Same campaign
| Organization | Affected | ||||
|---|---|---|---|---|---|
| Apr 275 months ago | Vendor breach | Media | Confirmed | 119Kacct | |
| Apr 135 months ago | Supply chain | Data brokers | Unverified | Unknown | |
| Apr 135 months ago | Vendor breach | Gaming | Unverified | Unknown |
History of this record
- 2026-09-25 · source_type: aggregator to press · seed source
- 2026-09-25 · source_url: https://haveibeenpwned.com/Breach/Zara to https://www.bleepingcomputer.com/news/security/zara-data-breach-exposed-personal-information-of-197-000-people/ · seed source
- 2026-09-25 · campaign: empty to anodot-2026 · seed source
- 2026-09-25 · country: empty to ES · seed source
- 2026-09-25 · sector: tech to retail · seed source
- 2026-09-25 · attack: extortion to third-party · seed source
- 2026-09-25 · data_types: ["emails","location","financial"] to ["emails","location","financial","other","messages"] · seed source
- 2026-09-25 · discovered: empty to 2026-04 · seed source
- 2026-09-25 · summary: In April 2026, the fashion brand Zara was among a number of organisations targeted by the ShinyHunters extortion group as part of their "pay or leak" campaign. The group claimed the breach was related to a compromise of the Anodot analytics to Inditex confirmed a breach involving a former technology provider after ShinyHunters used Anodot authentication tokens to take data from BigQuery and leaked 140 GB. Have I Been Pwned counted 197,400 people with emails, locations, purchase a · seed source
- 2026-09-25 · title: empty to Zara data stolen via Anodot tokens, 197,400 customers affected · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.