Kering data breach: Gucci and Balenciaga owner confirms hack, says no financial data leaked
Luxury brand owner Keringa SA reported a data breach linked to Shiny Hunters, revealing limited customer data but no financial information. The group claims to possess 7.4 million email addresses and has attempted ransom negotiations, which Kering has refused to engage in.
It says that no financial information, including bank account numbers, credit card details, or government-issued identification numbers, was involved in the leak.
"In June, we identified that an unauthorized third party gained temporary access to our systems and accessed limited customer data from some of our Houses. No financial information - such as bank account numbers, credit card information, or government-issued identification numbers - was involved in the incident," a Kering spokesperson told the BBC.
Shiny Hunters responsible for the attack, says report:
As per a BBC report, the cybercriminals behind the attack call themselves Shiny Hunters. The group claims to have obtained data linked to 7.4 million unique email addresses.
The group also shared a small sample of data with the publication as proof, which contained thousands of customer details.
Among the data stolen by cybercriminals is "Total Sales," which shows how much a customer has spent with each brand. The information is risky because it could lead to high-spenders being targeted via secondary hacks or scams if the cybercriminals decide to leak the information to other criminals.
The group told the BBC over Telegram that they had breached the luxury brands in April and contacted the French company in early June. They claim to be in on-and-off negotiations with the company, with the ransom to be paid in Bitcoin.
Kering, on its part, claims that it has not engaged in any conversations with the criminal and has refused to pay the hackers.
Kering SA, the owner of popular luxury brands Gucci, Saint Laurent, and Balenciaga, on Monday announced that it had fallen victim to a data breach that was discovered in June.
The company, in a statement to Bloomberg, said that it had accessed "limited customer data from some of our Houses." It also noted that those houses or brands had immediately disclosed the breach to relevant authorities and notified the customers.