Millions of Customer Records Stolen in Cyberattack on Gucci, Balenciaga, and Alexander McQueen

Luxury fashion group Kering has confirmed a major data breach affecting Gucci, Balenciaga and Alexander McQueen, with the cybercriminal group Shiny Hunters claiming to have stolen private details tied to as many as 7.4 million unique email addresses. Potentially millions of customers worldwide may now be at risk after names, email addresses, phone numbers, postal addresses and total spend data were accessed, though Kering declined to disclose the exact number of affected customers.

Investigations reveal that no payment card information or other sensitive financial details were compromised, and the attacker obtained customer profiles showing how much each person spent at the stores. Shiny Hunters claims to have infiltrated Kering’s systems back in April and reached out in June proposing ransom talks in Bitcoin, which the company says it did not accept, with Kering insisting no negotiations took place.

Google’s cybersecurity experts warn that Shiny Hunters—also dubbed UNC6040—has been exploiting employee access to internal Salesforce platforms by tricking staff into revealing login credentials. According to the BBC, a small sample of records indicated some individuals had spent more than $10,000, and a few high rollers totalled between $30,000 and $86,000.