CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Inditex (Zara) breach

incident · incident:inditex-zara-breach-2026

ShinyHunters third-party analytics breach at Inditex (Zara), 197,400 EU customers.

Coverage
1
first 2026-05-09 → last 2026-10-11
Latest activity
2026-05-09
Have I Been Pwned loads about 197,000 Zara customer emails after ShinyHunters leaked data it says came from…
Peak priority
routine
1 routine
Targets
retail
sectors: retail
Sources cited
3
3 hosts

Defender insights

What each entry about Inditex (Zara) breach tells a defender to do, newest first.

Story timeline

  1. 2026-05-09Zara customer emails exposed through a former Inditex technology provider; ShinyHunters claims Anodot token abuse and leaks the data
    active-threatsHave I Been Pwned loads about 197,000 Zara customer emails after ShinyHunters leaked data it says came from Anodot tokens against BigQuery

Hunting pivots

Tags
data-breachorganized-crimesupply-chain
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Credential AccessSteal Application Access Token
  • CollectionData from Cloud Storage

Credential Access TA0006

T1528Steal Application Access Token×1

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

Evidence: 2026-05-09/inditex-zara-shinyhunters-publishes-140-gb-197-400-eu-custom · ATT&CK page ↗

Collection TA0009

T1530Data from Cloud Storage×1

Adversaries may access data from cloud storage.

Evidence: 2026-05-09/inditex-zara-shinyhunters-publishes-140-gb-197-400-eu-custom · ATT&CK page ↗

Entries about Inditex (Zara) breach (1)

2026-05-09 · view entry permalink →

ROUTINEupdatedNATOB3

Zara customer emails exposed through a former Inditex technology provider; ShinyHunters claims Anodot token abuse and leaks the data

Inditex says databases hosted by a former technology provider, holding information about business relationships with customers in different markets, were accessed, and that customers' names, phone numbers, addresses, credentials and payment information were not; it has notified the relevant authorities but has not named the provider or attributed the breach (BleepingComputer, 2026-05-08). Have I Been Pwned found about 197,000 unique email addresses with product SKUs, order IDs and the market each support ticket originated in (Have I Been Pwned). ShinyHunters claims it stole the data with Anodot authentication tokens used against BigQuery and leaked a 140 GB archive (BleepingComputer, 2026-05-08); Have I Been Pwned describes the group's publication as a terabyte allegedly including 95 million support-ticket records (Have I Been Pwned).

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryprioritytagsregionstechniquessourcesverificationclassificationbody

Inditex confirms only that a former technology provider's databases were accessed (BleepingComputer, 2026-05-08); the analytics-platform route is ShinyHunters' claim about Anodot tokens (BleepingComputer, 2026-05-08). The email, order and support-ticket fields come from Have I Been Pwned's analysis, and the records concern customers in different markets, and no source limits them to the EU (Have I Been Pwned) (BleepingComputer, 2026-05-08). The size of the leak differs between sources, 140 GB (BleepingComputer, 2026-05-08) against about a terabyte (Have I Been Pwned).

incident09 May 05:00Zmulti-sourceOpen finding →
Sources: Security Affairs · BleepingComputer · Have I Been Pwned

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • bleepingcomputer.com1 (33%)
  • haveibeenpwned.com1 (33%)
  • securityaffairs.com1 (33%)
All cited sources (3)