Hackers steal customer records from Gucci, Balenciaga and Alexander McQueen

No financial data exposed, parent firm Kering says

Cybercriminals have stolen the personal details of potentially millions of Gucci, Balenciaga and Alexander McQueen customers in a major data breach targeting the French luxury group Kering.

The stolen records, obtained in April and disclosed to data protection authorities in June, include names, email addresses, phone numbers, home addresses and a unique "total sales" figure revealing how much each customer has spent at the brands' boutiques worldwide.

While Kering stressed that no financial data such as bank account or credit card details were exposed, the theft has raised serious concerns about the safety of high-value clients.

The ShinyHunters hacking group claims to have compromised data linked to 7.4 million unique email addresses.

A sample shared with the BBC contained thousands of apparently genuine records, including customer spending ranging from over $10,000 to as much as $86,000.

Analysts warn that this information could make wealthy clients attractive targets for scams and secondary cyberattacks if the dataset is leaked further.

Company confirms breach

In a statement, Kering acknowledged the incident, saying: "In June, we identified that an unauthorised third party gained temporary access to our systems and accessed limited customer data from some of our Houses. No financial information - such as bank account numbers, credit card information, or government-issued identification numbers - was involved in the incident."

The group confirmed it had since secured its IT infrastructure and notified all affected customers directly by email.

However, it has not disclosed the total number of victims and is not legally required to make the breach public as long as individuals were notified privately.

A ShinyHunters member told the BBC they had been in on-and-off ransom negotiations with Kering since June, demanding payment in Bitcoin.

Kering denies this, saying it has not engaged with the criminal group and has refused to pay, citing law enforcement advice against rewarding hackers.

The breach at Kering is part of a broader wave of cyberattacks against high-end retailers in 2024 and 2025.

Richemont's Cartier and several of LVMH's brands have also been targeted.

In July, Hong Kong's privacy watchdog announced an investigation into a data leak impacting 419,000 Louis Vuitton customers. It remains unclear whether Shiny Hunters was behind those incidents.

Experts warn of long-term risks

Cybersecurity specialists warn the breach poses long-term risks to luxury consumers.

"The latest breach affecting Gucci, Balenciaga and Alexander McQueen underlines the risks luxury brands face as prominent targets for cybercrime," said Joseph Rooke, Director of Risk Insights at Recorded Future's Insikt Group.

"Attackers are drawn to these companies not only because of the global recognition of their brands, but also because their customer bases include high-net-worth individuals whose personal details can be especially valuable."

He added that the exposure of spending data is particularly alarming: "While no payment information was taken, this incident is another critical reminder of the importance of protecting personal data across all systems, not just financial platforms."

Kevin Marriott, Senior Manager of Cyber and Head of SecOps at Immersive, noted the broader trend: "The attacks against Gucci, Balenciaga and Alexander McQueen continue the trend of attacks against high-end retailers observed throughout the year. The delay may have been Shiny Hunters negotiating payment to suppress the leak or verifying the dataset's contents. More concerningly, the release could mean they've already exploited it and now seek notoriety."

He warned that businesses must move beyond awareness campaigns: "With the impact on retailers still rolling on, businesses need to be confident in their cyber capabilities. Awareness is not enough any longer, enterprises should be continuously stress-testing their defences and drilling their all employees against cyber threats."