Breachesby GlyphZara
Disclosed May 8, 2026197,376 accountsUnverified
Zara data stolen via Anodot tokens, 197,400 customers affected
Inditex confirmed a breach involving a former technology provider after ShinyHunters used Anodot authentication tokens to take data from BigQuery and leaked 140 GB. Have I Been Pwned counted 197,400 people with emails, locations, purchase and support data.
What is known
| People affected | 197,376 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | May 8, 2026 |
| Discovered | Apr 2026 |
| Happened | Apr 15, 2026 |
| Attack | Vendor breach |
| Data exposed | EmailsLocationFinancialOtherMessages |
| Sector | Retail · ES |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
| Part of | Anodot (2026) |
| Check your email | Have I Been Pwned |
Sources
Notices filed
Same campaign
History of this record
aggregator to pressby seedSource
https://haveibeenpwned.com/Breach/Zara to https://www.bleepingcomputer.com/news/security/zara-data-breach-exposed-personal-information-of-197-000-people/by seedSource
empty to anodot-2026by seedSource
empty to ESby seedSource
tech to retailby seedSource
extortion to third-partyby seedSource
["emails","location","financial"] to ["emails","location","financial","other","messages"]by seedSource
empty to 2026-04by seedSource
In April 2026, the fashion brand Zara was among a number of organisations targeted by the ShinyHunters extortion group as part of their "pay or leak" campaign. The group claimed the breach was related to a compromise of the Anodot analytics to Inditex confirmed a breach involving a former technology provider after ShinyHunters used Anodot authentication tokens to take data from BigQuery and leaked 140 GB. Have I Been Pwned counted 197,400 people with emails, locations, purchase aby seedSource
empty to Zara data stolen via Anodot tokens, 197,400 customers affectedby seedSource
First recordedby backfillSource
First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.