Retail data breaches expose customer payment card information, loyalty program personal details, online account credentials, and employee records at stores, restaurants, and e-commerce companies. These exposures commonly lead to financial fraud, card-not-present fraud used for online purchases, and identity theft affecting both shoppers and staff, since retail breaches often involve point-of-sale systems, e-commerce checkout pages, or loyalty program databases containing large volumes of customer data. A single breach at a retail chain or its payment processor can affect millions of customers across many store locations at once, given how centralized modern retail payment and loyalty systems tend to be. Employees of breached retailers can also be affected separately, since payroll and HR systems are frequently stored alongside customer-facing systems. This page tracks confirmed data breaches at retail and e-commerce companies, including what data was exposed, which companies notified regulators, and what affected individuals can do next to protect their payment information and identity.
A ransomware attack by the Sinobi group hit Cohen’s Fashion Optical, exposing Social Security numbers, financial records, and internal documents belonging to consumers.
Fashion retailer Ralph Lauren was hit by a ShinyHunters extortion campaign that exposed the names, emails, phone numbers, genders and age groups of roughly 140,000 customers stored in its Salesforce system.
Ralph Lauren Data Breach Exposes Names, Emails, and Phone Numbers Read More »
A ShinyHunters extortion campaign exploited a zero-day flaw in Oracle PeopleSoft to steal HR data on 368,000 current and former JCPenney employees, including Social Security numbers and home addresses.
JCPenney Data Breach Exposes Social Security Numbers and Employee Data Read More »
Hackers known as ShinyHunters published 8.7 million records tied to Carnival’s Holland America Mariner Society loyalty program after an alleged extortion attempt failed.
Carnival Data Breach Exposes Names, Dates of Birth and Loyalty Program Data Read More »
A CarMax data breach tied to a failed extortion attempt exposed the personal information of roughly 431,000 people, including names, emails, phone numbers and physical addresses.
CarMax Data Breach Exposes Names, Emails, Phone Numbers and Addresses Read More »
A Canada Goose data breach tied to a third-party vendor incident exposed 920,000 customer records, including names, addresses, phone numbers and partial credit card data.
Canada Goose Data Breach Exposes Names, Addresses and Partial Card Data Read More »
Beckett Collectibles suffered a data breach and website defacement in November 2025, with hackers stealing and publicly leaking over 1 million customer records including names, emails, phone numbers and addresses.
Beckett Collectibles Data Breach Exposes Names, Emails and Phone Numbers Read More »
Baker Distributing Company, an HVAC/R wholesale distributor, had customer contact information and support tickets published online after the ShinyHunters extortion group claimed to steal data from its SharePoint and Salesforce systems.
Baker Distributing Data Breach Exposes Customer Contact Information Read More »
A federal court filing reveals that Scattered Spider hackers breached a luxury jewelry retailer in May 2025, stealing at least 77 gigabytes of data through a help desk social engineering scheme.
Luxury Jewelry Retailer Data Breach Exposes Stolen Company Data After Help Desk Attack Read More »
Hank's Furniture discovered that an unauthorized individual accessed files containing sensitive personal information, including full names, Social Security numbers, government-issued ID details, and financial information. Customers and possibly employees whose data was stored in company systems may be affected. Anyone who received a notification letter should read it carefully first to confirm what information was