Zara data breach exposed data from 197,400 customers, Inditex says

A data breach involving Zara, the flagship brand of Inditex Group, exposed data tied to 197,400 customers, according to an analysis by data-breach notification service Have I Been Pwned.

The exposed information included email addresses, product SKUs, order IDs, and the market in which support tickets originated. Inditex said the affected databases were hosted by a former technology provider.

Inditex said the incident did not expose customers’ names, phone numbers, postal addresses, account credentials, or payment information. The company added that its internal operations and systems were not affected.

An extortion group has claimed responsibility for the breach, alleging it stole a 140GB archive. The group has been linked in prior incidents to data thesources involving compromised authentication tokens.

The incident underscores supply-chain risk tied to third-party providers. Inditex has not identified the former technology provider involved or attributed the breach to a specific threat actor beyond noting the incident originated outside its own systems.