Zara Data Breach

In April 2026, attackers gained unauthorized access to Zara's customer databases and exfiltrated 197,400 records. The stolen data included customer names, email addresses, phone numbers, and order histories. The breach was confirmed by Have I Been Pwned on May 8, 2026. Zara confirmed the incident and stated that payment card information was not compromised.

Zara is one of the world's largest fashion retailers, operating over 2,000 stores in 96 countries as part of the Inditex Group.

The exact access method was not publicly disclosed. The breach targeted customer databases, suggesting server-side compromise or credential access.

Unknown threat actors.

Attribution sources

• Have I Been Pwned
• Zara statements

Countries affected

• Global

Data types

• PII
• Names
• Email addresses
• Phone numbers
• Order histories

Public reaction

Concern among global customers about retail data security.

Potential GDPR investigation.

Significance

Highlights continued data security challenges in global fast-fashion retail.

Publishing organisations

• BleepingComputer
• Have I Been Pwned

Zara confirmed the breach and notified affected customers.

Official documents

• Zara data breach notification

References

1. [1]BleepingComputer: Zara data breach coverage
2. [2]Have I Been Pwned - Zara listing