Luxury Brands Under Siege: The 2025 Cyberattack Wave Targeting High-End Retail
From Gucci to Chanel, cybercriminals are systematically targeting luxury retailers in unprecedented coordinated campaigns
The luxury retail sector is experiencing an unprecedented wave of cyberattacks in 2025, with some of the world's most prestigious brands falling victim to sophisticated cybercriminal campaigns. From Kering's portfolio of Gucci, Balenciaga, and Alexander McQueen to standalone luxury houses like Chanel and Cartier, high-end retailers are discovering that their exclusive clientele makes them prime targets for data theft and extortion.
Breached Company
The Kering Catastrophe: Shiny Hunters Strike Gold
The most recent high-profile incident involves Kering, the French luxury conglomerate behind Gucci, Balenciaga, and Alexander McQueen. Cybercriminals operating under the "Shiny Hunters" moniker claim to have stolen data linked to 7.4 million unique email addresses, including customer names, email addresses, phone numbers, addresses, and crucially, total spending amounts at each brand.
The breach, which occurred in April 2025 but only came to light in September, reveals particularly concerning details about customer purchasing power. Analysis of the leaked data shows some customers have spent more than $10,000 with individual brands, while a handful have accumulated spending of $30,000-$86,000. This wealth data makes victims particularly vulnerable to secondary attacks and targeted scams.
Kering has confirmed the breach, stating: "In June, we identified that an unauthorized third party gained temporary access to our systems and accessed limited customer data from some of our Houses." The company has refused to pay ransom demands, following long-standing law enforcement advice, but this decision has resulted in the threat actor threatening to sell the data to other criminals.
The LVMH Empire Under Attack
French luxury giant LVMH has suffered a particularly devastating series of breaches throughout 2025, with multiple subsidiaries targeted in what appears to be a coordinated campaign:
Louis Vuitton Global Breach
In July 2025, Louis Vuitton confirmed a multi-country cyberattack affecting customers in the UK, South Korea, Turkey, Italy, and Sweden. The attack, attributed to the ShinyHunters group, exposed customer names, contact information, and purchasing histories. In Turkey alone, 142,995 individuals were affected. The hackers reportedly maintained access to compromised systems for nearly a month before detection.
Christian Dior Couture
Dior disclosed in May 2025 that customer data had been compromised in a breach that actually occurred in January but went undetected for months. The attack primarily affected customers in Asia, particularly South Korea and China, and originated from a third-party vendor managing global customer data.
Tiffany & Co.
The luxury jewelry brand suffered a breach on April 8, 2025, affecting South Korean customers. Hackers gained access through a third-party vendor's platform, stealing personal information including names and contact details.
The Chanel Salesforce Campaign
In late July 2025, Chanel became the latest victim in a sophisticated campaign targeting Salesforce customer relationship management (CRM) systems. The attack, detected on July 25, compromised a database hosted by a third-party service provider, exposing names, email addresses, mailing addresses, and phone numbers of US customers who had contacted Chanel's client care center.
This incident is part of a broader wave of Salesforce-linked attacks that have also hit Adidas, Qantas, Allianz Life, and other major brands. The attacks use advanced social engineering techniques, including voice phishing (vishing) to trick employees into authorizing malicious OAuth applications that appear as legitimate Salesforce tools.
The Scattered Spider Network
Beyond the luxury-focused attacks, a separate but equally devastating campaign has been attributed to the Scattered Spider cybercrime group and their affiliates. This network has been particularly active targeting both UK and US retailers:
Victoria's Secret
In May 2025, Victoria's Secret suffered a cyberattack that forced the company to shut down its corporate systems and e-commerce website for several days. The incident delayed the company's earnings report and is expected to cost approximately $20 million in lost sales. The attack bore the hallmarks of Scattered Spider's sophisticated social engineering tactics.
UK Retail Devastation
The same period saw a devastating wave of attacks against British retailers:
- Marks & Spencer: A cyberattack in April 2025 severely disrupted online operations and is expected to cost the retailer up to £300 million ($400 million) in lost profits and operational disruptions.
- Harrods: The luxury department store sustained cyberattacks but managed to minimize operational impact.
- Co-op Group: Suffered a major customer data breach as part of the coordinated campaign.
Cartier and the Expanding Target List
In June 2025, Cartier confirmed that cybercriminals had gained unauthorized access to its systems, compromising customer names, email addresses, and countries of residence. While the luxury jeweler emphasized that no payment information was accessed, the incident added another prestigious name to the growing list of luxury brands under attack.
The Perfect Storm: Why Luxury Brands Are Prime Targets
Several factors make luxury retailers particularly attractive to cybercriminals:
High-Value Customer Data
Luxury brand customers represent high-net-worth individuals whose personal information commands premium prices on dark web markets. The spending data revealed in breaches like Kering's provides criminals with ready-made target lists for secondary scams and extortion attempts.
Reputational Vulnerability
Luxury brands are built on exclusivity, trust, and prestige. A data breach can cause disproportionate reputational damage compared to mass-market retailers, making these companies more likely to pay ransoms to prevent disclosure.
Complex Third-Party Ecosystems
Many luxury brands rely on sophisticated third-party vendors for customer management, e-commerce, and international operations. These complex supply chains create multiple attack vectors that are difficult to monitor and secure comprehensively.
Limited Cybersecurity Investment
Despite their financial resources, many luxury brands have historically focused investment on physical security and brand protection rather than cybersecurity infrastructure, leaving them vulnerable to modern digital threats.
Attack Methodologies: A New Level of Sophistication
The 2025 luxury retail attacks demonstrate unprecedented levels of coordination and sophistication:
Social Engineering Excellence
Groups like Scattered Spider have perfected voice phishing techniques, with attackers impersonating IT support teams to trick employees into providing access credentials or authorizing malicious applications.
Third-Party Exploitation
Rather than attacking luxury brands directly, criminals are increasingly targeting less-secure third-party vendors and service providers who have access to valuable customer databases.
Supply Chain Infiltration
The attacks on LVMH subsidiaries suggest cybercriminals are systematically mapping corporate structures and shared vendors to maximize their impact across multiple brands simultaneously.
Long-Term Persistence
Many breaches went undetected for weeks or months, allowing attackers to thoroughly map networks and exfiltrate maximum amounts of data before discovery.
Financial and Reputational Consequences
The financial impact of these attacks extends far beyond immediate losses:
- Victoria's Secret: $20 million in projected Q2 losses
- Marks & Spencer: £300 million in estimated costs
- Louis Vuitton: Estimated costs in the millions across multiple countries
- Industry Average: Retail data breaches now cost an average of $3.48 million, representing an 18% increase from 2023
Beyond direct costs, luxury brands face unique challenges in maintaining customer trust and brand prestige following security incidents.
The ShinyHunters Connection
Intelligence analysis suggests that many of these attacks are connected through the ShinyHunters extortion group and its affiliated networks. This cybercriminal organization has developed a sophisticated business model:
- Target Selection: Focusing on high-value customer databases in luxury retail
- Data Extraction: Using advanced techniques to steal comprehensive customer records
- Private Extortion: Contacting victims with ransom demands before public disclosure
- Secondary Sales: Selling data on dark web markets when ransom demands are refused
Industry Response and Defensive Measures
The luxury retail industry is beginning to adapt to this new threat landscape:
Enhanced Third-Party Security
Brands are implementing more rigorous security requirements for vendors and conducting regular audits of third-party access privileges.
Employee Training
Companies are investing in comprehensive social engineering awareness training, particularly around voice phishing and OAuth application authorization.
Incident Response Planning
Luxury brands are developing specialized incident response plans that account for the unique reputational risks they face during security incidents.
Threat Intelligence Sharing
Industry groups are beginning to share threat intelligence more effectively to identify coordinated campaigns early.
Regulatory and Legal Implications
The wave of luxury retail breaches is attracting increased regulatory attention:
- GDPR Enforcement: European authorities are conducting investigations into several incidents affecting EU customers
- SEC Requirements: US-listed companies face increasing pressure for timely breach disclosure
- Class Action Lawsuits: Multiple luxury brands are facing customer lawsuits over inadequate data protection
Looking Ahead: The Future of Luxury Retail Security
As cybercriminals continue to refine their tactics, luxury retailers must fundamentally rethink their approach to cybersecurity:
Zero-Trust Architecture
The sophistication of social engineering attacks is driving adoption of zero-trust security models that verify every access request regardless of source.
AI-Powered Defense
Luxury brands are investing in artificial intelligence systems capable of detecting the subtle signs of advanced persistent threats and social engineering campaigns.
Customer Communication
Brands are developing more transparent communication strategies to maintain trust during and after security incidents.
Insurance and Risk Management
The luxury sector is reassessing cybersecurity insurance coverage and developing more sophisticated risk assessment frameworks.
Conclusion: A New Reality for Luxury Retail
The 2025 wave of cyberattacks against luxury retailers represents a fundamental shift in the threat landscape. Cybercriminals have recognized that high-end brands offer a unique combination of valuable customer data, reputational vulnerability, and often inadequate cybersecurity defenses.
The coordinated nature of these attacks—spanning multiple criminal groups and targeting everything from third-party vendors to social engineering vulnerabilities—suggests that luxury retail has become a primary focus for sophisticated cybercriminal operations.
For luxury brands, the message is clear: the days when physical security and brand protection were sufficient are over. In an interconnected digital economy, cybersecurity is not just an IT concern—it's a fundamental business risk that can threaten the very exclusivity and trust that luxury brands depend on.
As investigations continue into incidents at Kering, LVMH, Chanel, and others, the luxury retail industry faces a critical choice: invest significantly in cybersecurity infrastructure and training, or continue to provide attractive targets for increasingly sophisticated cybercriminal operations.
The cost of inaction, as demonstrated by the hundreds of millions in losses already sustained, far exceeds the investment required for proper protection. For an industry built on trust and exclusivity, there may be no second chances.
