Spanish fashion retailer MANGO disclosed a data breach

Spanish fashion retailer MANGO disclosed a data breach that arose after its marketing vendor was compromised, exposing customer personal data used in marketing campaigns. According to the Spanish Data Protection Agency (AEPD), the exposed information is limited to personal contact data: first name, country, postal code, email address, and phone number, with the last name not compromised.

The company stated that the breach did not affect sensitive data such as banking details, ID or passport information, login credentials, or passwords, and that internal systems were not impacted. Data breach notifications were sent to affected customers on 14 October 2025. Mango, founded in Barcelona in 1984, operates over 2,850 stores in 120 countries and employs around 16,400 people, with 2024 revenue of €3.3 billion and profit of €219 million; online sales account for about a third of total revenue. At the time of writing, no ransomware groups had claimed responsibility for the attack.