Inside the Benetton breach: 371,382 records and emails exposed

In December 2022, Benetton's Indian eCommerce platform experienced a database breach that occured without any immediate public disclosure, exposing the personal information of 371,382 customers. The leaked dataset contained email addresses, phone numbers, first names, and last names, representing a significant volume of personally identifiable information from one of the fashion industry's well-known brands. This incident underscores how large retail platforms operating in high-growth markets can become attractive targets for data theft.

Why Exposed Phone Numbers and Emails Create Serious Risk

The combination of phone numbers, email addresses, and full names leaked in the Benetton breach gives criminals multiple direct channels to reach affected customers with fraudulent communications. Attackers can use this data to conduct SMS phishing (smishing) campaigns, voice fraud calls, and highly targeted email scams that are partcularly convincing because they use the victim's real name. Customers who recieved unexpected messages from unknown contacts referencing their Benetton account should treat these as potential exploitation attempts.

What Was Exposed in the Benetton Breach

• Email Address
• Phone Number
• First Name
• Last Name

Why the Benetton Breach Still Matters Today

With over 371,000 records in circulation, the Benetton breach represents a substantial pool of data that threat actors can use for targeted fraud, account takeover attempts, and social engineering campaigns for years to come. Breached customer data from eCommerce platforms is frequently combined with data from other leaks to build more complete identity profiles, amplifying the risk to individual users. Anyone who shopped on Benetton's Indian platform and used the same email or phone number across multiple services faces compounded exposure risk.

How Database Breaches Work

A database breach happens when an unauthorized party gains access to a company's backend data storage systems, often through vulnerabilities in web applications, misconfigured databases, or compromised credentials. Attackers typically export customer tables containing names, contact details, and account information before the intrusion is detected. The stolen records are then distributed on underground forums, sold to other criminal actors, or used directly in fraud campaigns targeting the affected individuals.

Check If Your Data Was Exposed

HEROIC maintains a breach intelligence database of more than 400 billion records, covering thousands of incidents including retail breaches like the one affecting Benetton's Indian platform. Use HEROIC's free check to instantly see whether your email address or phone number appears in this or any other known data leak, so you can take targeted steps to protect your accounts and personal information today.