"On September 11, DataBreaches broke the story that customers of several high-end fashion brands owned by Paris-headquartered Kering had their personal information acquired by ShinyHunters as part of two Salesforce attacks. As we reported, a spokesperson for ShinyHunters claimed to have acquired more than 43 million customer records from Gucci and almost 13 million records from Balenciaga, Brioni, and Alexander McQueen combined."
"Kering never responded to emailed inquiries, but ShinyHunters provided DataBreaches with samples from both attacks that appeared legitimate. They also provided chat logs from negotiations they claimed took place with someone presenting themselves as Balenciaga's safety manager. Those negotiations appeared to go on for more than a month and a half between June 20 and mid-August. According to the logs, it appeared Kering agreed to pay a ransom of 500,000 euros, but then they went silent and never followed through."
"" En juin 2025, nous avons constaté qu'un tiers non autorisé avait temporairement accédé à nos systèmes et consulté des données clients limitées provenant de certaines de nos Maisons ", explique le service de presse de Kering dans une déclaration adressée à la rédaction. Celle-ci ajoute que " nos Maisons ont immédiatement signalé cette intrusion aux autorités compétentes et ont informé les clients conformément aux réglementations locales ". Et de préciser qu'aucune " information financière, telle que des numéros de compte bancaire ou de"
ShinyHunters claims to have obtained over 43 million Gucci customer records and nearly 13 million records from Balenciaga, Brioni, and Alexander McQueen after two Salesforce breaches. Samples and chat logs provided by ShinyHunters appeared legitimate and showed negotiations with someone identifying as Balenciaga's safety manager between June 20 and mid‑August. The logs indicate an agreed ransom of €500,000 that Kering did not pay. Kering initially did not respond to emailed inquiries and later issued a statement acknowledging temporary unauthorized access in June 2025, saying affected Houses notified authorities and customers and that no financial account information was accessed.
Read at DataBreaches.Net
Unable to calculate read time
Collection
[
|
...
]