Zara Data Breach

What happened?

In April 2026, the fashion brand Zara was among a number of organisations targeted by the ShinyHunters extortion group as part of their "pay or leak" campaign. The group claimed the breach was related to a compromise of the Anodot analytics platform and subsequently published a terabyte of data allegedly including 95M support ticket records. The data contained 197k unique email addresses alongside product SKUs, order IDs and the market the support ticket originated in. Zara's parent company Inditex advised that the incident didn't affect passwords or payment information .

When did it happen?

The breach date in the public record is April 15, 2026. The record was added to the catalogue on May 8, 2026 and last updated there on May 8, 2026.

What information was reported as exposed?

• Email addresses
• Geographic locations
• Purchases
• Support tickets

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with Zara or used zara.com around April 15, 2026. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.