Zara data breach: what leaked and what to do
Zara (zara.com) had a data breach on 2026-04-15 affecting 197,376 accounts.
!Personal data leaked
Added to the catalogue 8 May 2026.
What leaked
- Email addresses
- Geographic locations
- Purchases
- Support tickets
What happened
In April 2026, the fashion brand Zara was among a number of organisations targeted by the ShinyHunters extortion group as part of their "pay or leak" campaign. The group claimed the breach was related to a compromise of the Anodot analytics platform and subsequently published a terabyte of data allegedly including 95M support ticket records. The data contained 197k unique email addresses alongside product SKUs, order IDs and the market the support ticket originated in. Zara's parent company Inditex advised that the incident didn't affect passwords or payment information.
Description from Have I Been Pwned, in its words.
What to do
- Warn staff: emails, texts or calls quoting leaked details are not proof the sender is genuine.
- If card or bank details leaked, watch statements and tell the bank; if identity documents leaked, consider a credit ban or alert.
- Turn on two-factor sign-in on that service and on your email.
Common questions
What leaked in the Zara breach?
Email addresses, Geographic locations, Purchases, Support tickets
When did the Zara breach happen?
The breach date is 2026-04-15; it was added to the public catalogue on 2026-05-08.
What should I do if my staff used this service?
Warn staff about emails, texts and calls quoting the leaked details, and watch for sign-in attempts on the services they use.
Was a staff address in this breach?
Check one address free, no storage. Breach Watch checks every staff address after each new breach.