Allegation: regular Swarovski account allegedly exposed 103,674 shoppers' records
A source told FrenchBreaches that a regular Swarovski customer account could pull other shoppers' names, birth dates, postal addresses, emails and some phone numbers, with no passwords or card details. The source claims 103,674 records across 8 countries, led by China, the US and the UK. Swarovski has not confirmed the incident or said whether the flaw is fixed, and FrenchBreaches says the 1,000-row sample alone cannot show the data came from a recent breach.
What happened
A source told FrenchBreaches that a regular Swarovski customer account was enough to pull other shoppers' names, birth dates and postal addresses. The claim covers 103,674 records across 8 countries, led by China, the US and the UK, with no passwords or card details. Swarovski has not confirmed the incident.
Why it matters
If confirmed, customer personal data is exposed to targeted scams and phishing, with reputational risk for the brand. The absence of passwords and card data lowers direct financial risk, but names, addresses and birth dates still enable targeted fraud.
What to do
Wait for Swarovski's official statement on the case and on whether the flaw is fixed. Advise customers to distrust messages that cite their personal data pending confirmation.
For the technical team
- Affected
- Swarovski Contas de cliente do site da Swarovski; acesso a dados de outros compradores · Swarovski website customer accounts; versions not specified in the source.
- Exploitation
- No confirmed exploitation. Claim made by a source to FrenchBreaches, which reviewed a 1,000-row sample and says it alone cannot show the data came from a recent breach.
- Fix
- Unknown. Swarovski has not said whether the flaw is fixed.
- Vector
- Alleged flaw on the Swarovski website: a regular customer account was enough to pull other shoppers' data. Exploitation condition: holding a customer account. The source gives no technical mechanism.
- More details
- Data alleged in the sample: names, birth dates, postal addresses, emails and some phone numbers; no passwords or card details. Alleged scope: 103,674 records across 8 countries, led by China, the US and the UK. Swarovski has not confirmed the incident.
Timeline
Incident opened.
Sources 1 source
- @IntCyberDigest @IntCyberDigest
