Tiffany discloses data breach involving gift cards — second breach disclosure in recent months

Tiffany & Co. has disclosed a second data breach this year involving Tiffany gift cards, affecting 2,590 people. The notification to affected individuals, submitted to the Maine Attorney General’s Office, states the cybersecurity incident occurred on or around 12 May 2025, and that on 9 September 2025 it was determined that an unauthorized party obtained certain information related to the gift cards.

The compromised data reportedly included client name, postal address, email address, phone number, sales data, internal client reference number, and Tiffany gift card number and PIN, with not all elements affected for every individual. The report also notes that Tiffany’s earlier breach in South Korea occurred in May, with a 26 May notification to select customers about a breach linked to a vendor platform and possibly connected to ShinyHunters’ campaigns tracked by Google Threat Intelligence Group as UNC6040.

DataBreaches says ShinyHunters declined to comment, and LVMH has not provided clarification on whether the two reports are related; the group is associated with extortion demands that reportedly led to a payment of 4 BTC.