Mango discloses data breach at third-party provider

Mango has disclosed a data breach at one of its external marketing service providers, with Mango stating that only personal contact information was exposed and its own systems were not affected. According to the breach notification, the stolen data were limited to first name (not your last name), country, postal code, email address and telephone number, with Mango emphasising that banking information, credit cards, ID or login credentials were not compromised.

Because Mango operates in more than 100 countries, affected individuals could be located across multiple regions where the retailer markets via its external partner, though Mango has not named the third‑party provider or disclosed how many customers were affected. The company has not released details about the attackers behind the breach, and Malwarebytes notes that while the stolen data pose no immediate risk, cybercriminals often follow breaches with phishing campaigns. Mango posted the update on 16 October 2025, and Malwarebytes says it will report further if Mango releases more information about affected customers.