Luxury Jeweler Tiffany Reports Data Breach Exposing User Personal Data

According to GBHackers on Security, luxury jeweller Tiffany and Company has confirmed a data breach that exposed the personal information of 2,590 customers. The company detected unauthorized access to an external system on 9 September 2025, though the incident is believed to have first begun on 12 May 2025. Affected customers were notified in writing on 16 September 2025, and Tiffany filed a breach notification with Maine authorities as required by state law.

The breach involved an external system that was hacked, allowing the intruder to acquire names or other personal identifiers alongside additional customer data, with typical identifiers including mailing addresses, email addresses, and phone numbers; the total impact was 2,590 individuals across the United States, including five Maine residents.

Tiffany, which did not engage credit bureaus due to the small number of Maine residents affected, has retained outside counsel Hunton Andrews Kurth LLP to oversee the notification process, and the formal notice was submitted by partner Lisa Sotto on Tiffany’s behalf, providing the company’s street address at 200 Fifth Avenue, New York, NY 10010.

The retailer has begun a security review, plans to implement multi-factor authentication on all external access points, and is advising customers to monitor account statements and credit reports while remaining vigilant for suspicious communications.