An extortion group claims it stole over a million LoveSac customer order records, including names, addresses, phone numbers, and order details, dating back to December 2019. LoveSac has not confirmed the breach. Affected customers should watch for phishing attempts referencing past orders and monitor accounts for suspicious activity.
| Company | LoveSac |
|---|---|
| Industry | Retail |
| Data Types Exposed | Full Names, Billing Addresses, Shipping Addresses, Telephone Numbers, Order Numbers and Dates, Order Grand Totals |
| People Affected | 1,113,285 records |
| Attack Method | Ransomware/Extortion Claim |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the LoveSac Data Breach?
A ransomware and extortion group claims it broke into the systems of furniture retailer LoveSac and stole a large database of customer order records. According to the group’s own leak-site posting, the stolen data spans nearly seven years of transactions. LoveSac has not publicly confirmed this claim as of this writing.
The group says the activity involved unauthorized access to LoveSac’s network, with the intrusion reportedly discovered around October 2026. However, no independent confirmation of the timeline, entry method, or scope has come from the company itself. As a result, key details about how the alleged breach occurred remain unverified.
Because this report originates from a threat actor’s extortion listing rather than a company statement or regulatory filing, important facts are still unclear. For example, it is not confirmed whether LoveSac has launched a forensic investigation or notified law enforcement. Readers should treat the claim as unconfirmed until LoveSac or an official source verifies it.
Who was affected?
The leak-site posting claims the stolen database includes order records tied to LoveSac customers who made purchases between December 2019 and October 2026. If accurate, this would mean current and former customers across the company’s US retail footprint could be involved.
LoveSac operates more than 250 showrooms nationwide, so any confirmed exposure could reach a geographically broad customer base. The claimed dataset reportedly contains 1,113,285 order records. That said, this figure comes from the extortion group’s own claim and has not been independently verified by LoveSac or a regulator.
There is no indication in the available information that employee data, minors, or health-related information are involved. Instead, the claim centers specifically on customer transaction records. Still, because the company has not confirmed the incident, the true scope of who is affected remains unknown.
What Information Was Potentially Exposed?
Based solely on the extortion group’s own claims, the following categories of customer information are alleged to be part of the stolen database. These categories have not been confirmed by LoveSac itself.
- Full customer names
- Billing addresses
- Shipping addresses
- Telephone numbers
- Order numbers and order dates
- Order statuses
- Order grand totals
If this claim proves accurate, the exposed information would mostly consist of contact and purchase-history details rather than financial account numbers or government ID numbers. Even so, names paired with addresses and phone numbers can fuel targeted phishing attempts. Scammers often use real order details to make fraudulent messages feel legitimate.
For example, a scammer could reference a real past LoveSac order to trick a customer into clicking a malicious link or sharing payment information. In addition, combined contact details can be sold or combined with other leaked data to build fuller profiles for identity theft. Because the claim itself has not been verified, affected customers should still stay alert, but should avoid assuming worse-case data types like Social Security numbers were involved unless LoveSac confirms it.
What is the company doing?
LoveSac has not issued a public statement confirming or denying this claimed breach. Therefore, it is not currently known whether the company is investigating the incident, has engaged a forensic firm, or plans to notify affected customers directly.
Because no regulator filing or company notice has been identified for this incident, it remains an unconfirmed claim made by an extortion group. If LoveSac later confirms the incident, additional details about remediation steps, notification timelines, and any protective services offered would typically follow. Until then, customers should rely on official LoveSac communications rather than the attacker’s own claims for guidance.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Even though this incident remains unconfirmed, it is wise for anyone who has ordered from LoveSac to check their credit reports periodically. You can request a free copy from each of the three major credit bureaus through AnnualCreditReport.com. Look for unfamiliar accounts, inquiries, or addresses that do not match your own history.
Regular monitoring helps you catch fraudulent activity early. If you spot anything suspicious, you can place a fraud alert with the credit bureaus and dispute inaccurate entries. This habit is useful regardless of whether this particular claim is ever verified.
Stay Alert for Phishing Attempts
Because names, addresses, and phone numbers are the data types claimed in this incident, phishing and smishing attempts are the most realistic risk. Be cautious of unexpected emails or texts referencing a past LoveSac order, especially ones asking you to click a link or confirm payment details.
Instead of clicking links in unsolicited messages, visit LoveSac’s official website directly by typing the address yourself. If a message claims to be from LoveSac customer service, verify it through a phone number listed on the company’s own site. This simple step can prevent many common scams.
Review Your Accounts for Unusual Activity
Because order details and contact information are involved in the claim, it is reasonable to review recent bank and credit card statements tied to any LoveSac purchases. Look for charges you do not recognize, however small.
If you find anything suspicious, contact your bank or card issuer right away to dispute the charge. In addition, consider updating passwords for any online accounts linked to the same email address or phone number used with LoveSac, since reused credentials can widen the impact of any data exposure.
Consider a Fraud Alert if More Details Emerge
At this stage, there is no confirmed evidence that Social Security numbers or financial account numbers were exposed in this claimed incident. As a result, a full credit freeze may not be necessary yet. However, placing a free fraud alert with one credit bureau is a low-effort precaution that extends to all three.
If LoveSac later confirms the breach and identifies more sensitive data types, affected individuals should revisit this decision and consider a full credit freeze. Keeping an eye on official updates from LoveSac will help you decide when stronger protective steps are warranted.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.