Every story tagged Customer Data, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
3 stories · open in the command center
Rituals, a €2.4 billion cosmetics retailer with 41 million customers, disclosed a data breach of its membership database affecting customers across Europe, the UK, and the US, exposing names, dates of birth, addresses, phone numbers, and account preferences. This incident exemplifies the growing targeting of retail customer databases for extortion, requiring IT organizations to strengthen identity and access controls, audit third-party data handling practices, and implement robust breach detection capabilities. The breach underscores critical governance gaps, as Rituals declined to provide breach timeline details or affected customer counts, indicating potential deficiencies in incident response and stakeholder communication protocols.
Fashion retailer Express exposed sensitive customer data including names, addresses, phone numbers, emails, and partial payment card information through a misconfigured web vulnerability that allowed sequential order number manipulation to access other customers' records. This incident exemplifies a critical pattern of preventable data exposures among major retailers and underscores the urgent need for IT organizations to implement robust access controls, secure APIs, and vulnerability disclosure programs to mitigate data breach risks and regulatory compliance obligations. The company's inability to quickly notify customers and lack of a clear security incident response process highlights the business and reputational damage that inadequate security maturity can inflict on large enterprises.
Booking.com confirmed unauthorized access to customer data including names, emails, phone numbers, and booking details, with evidence that attackers are already leveraging stolen information for targeted phishing attacks via WhatsApp. The company has not disclosed the number of affected customers, though with 6.8 billion bookings since 2010, the potential scope is significant. This incident follows a 2024 breach involving stalkerware on hotel systems accessing Booking.com portals, suggesting persistent security vulnerabilities in the travel booking ecosystem that could impact partner integrations and customer trust.