Have I Been Pwned 等泄露通报信息显示,约 197,400 条 Zara 相关记录受影响,外泄内容包括邮箱、地区/市场、购买或订单信息以及客服工单数据。 Inditex 称事件源于前技术供应商处的未授权访问,并表示密码和支付卡信息未被访问;但这些数据仍可能被用于更精准的钓鱼诈骗。

Create a landscape editorial hero image for this Studio Global article: What personal data was exposed in the Zara third-party breach, and how did ShinyHunters gain access to it?. Article summary: The exposed Zara data reportedly included about 197,400 customer records, mainly email addresses, geographic/location market data, purchase/order information, and support-ticket data. ShinyHunters appears to have accesse. Topic tags: general, general web. Reference image context from search candidates: Reference image 1: visual subject "# Zara Data Breach Exposed Personal Information of 197,000 People. Have I Been Pwned has confirmed that a data breach at Spanish fast-fashion retailer Zara exposed the personal inf" source context "Zara Data Breach Exposed Personal Information of 197,000 People" Reference image 2: visual subject "# Zara Data Breach Exposed Personal Information of 197,000 People.
Zara 这次事件的重点,不是传统意义上的“收银台被攻破”或“银行卡库被偷”,而是一次第三方数据暴露。Zara 母公司 Inditex 将事件归因于一家前技术供应商处的未授权访问;数据泄露通知服务 Have I Been Pwned 列出的受影响人数约为 197,400 人。[1][
4][
5]
从已公开报道看,外泄数据没有达到密码或支付卡信息泄露的程度,但足以让钓鱼邮件变得更像真的:攻击者若能提到你的邮箱、所在市场、订单或客服记录,普通用户更容易放松警惕。[4][
10]
Have I Been Pwned 将 Zara 事件列为影响超过 197,000 人,多篇报道给出的具体数字为 197,400 条记录。[4] 目前报道中提到的外泄字段包括:
Studio Global AI
Use this topic as a starting point for a fresh source-backed answer, then compare citations before you share it.
Have I Been Pwned 等泄露通报信息显示,约 197,400 条 Zara 相关记录受影响,外泄内容包括邮箱、地区/市场、购买或订单信息以及客服工单数据。
Have I Been Pwned 等泄露通报信息显示,约 197,400 条 Zara 相关记录受影响,外泄内容包括邮箱、地区/市场、购买或订单信息以及客服工单数据。 Inditex 称事件源于前技术供应商处的未授权访问,并表示密码和支付卡信息未被访问;但这些数据仍可能被用于更精准的钓鱼诈骗。
安全报道将事件与 ShinyHunters 联系起来,并称其疑似使用被盗的 Anodot 身份验证令牌访问 BigQuery 数据环境;完整技术细节尚未由 Inditex 公开。
继续“比特币独揽7.061亿美元:加密基金连续六周净流入”以获得另一个角度和额外的引用。
打开相关页面对照“MV Hondius号撤离时间线:汉坦病毒暴发后,乘客如何离船”交叉检查此答案。
打开相关页面Inditex, the Spanish retail giant behind Zara, has confirmed a data breach that exposed the personal information of 197,000 people. The breach did not originate inside Inditex's own systems. Instead, it traced back to a former third-party technology provide...
Inditex confirmed unauthorized access tied to a former technology provider, and Have I Been Pwned says 197,400 people were affected . The good news: Inditex says key data like passwords and payment card info wasn’t accessed . The bad news: the leaked detail...
Hackers who gained access to the databases of Spanish fast-fashion retailer Zara stole data belonging to more than 197,000 customers, according to data breach notification service Have I Been Pwned. ... While Inditex and Zara have yet to disclose more deta...
On May 8, 2026, the breach notification service Have I Been Pwned added Zara to its database, formalizing what ShinyHunters had been threatening for weeks. The dataset that ended up on the leak portal contained 197,400 unique email addresses tied to Zara cu...
这些信息单独看未必“致命”,但组合起来很有价值。比如一封声称来自 Zara 的邮件,如果能准确写出某个订单、商品或售后问题,就更像真实通知。Cloaked 的分析也提醒,即便没有密码和银行卡号,泄露细节仍可能被用于钓鱼和账户接管尝试。[4]
Inditex 据称表示,密码和支付卡信息没有被访问。[4] Daily.dev 的摘要还称,姓名、电话号码、地址、凭据和支付数据未受影响;不过,这一点仍应与另一个现实一起看:Inditex 尚未公开完整的技术复盘和细节说明。[
5][
10]
随后,多家安全报道将事件与勒索组织 ShinyHunters 联系起来。BleepingComputer 报道称,ShinyHunters 宣称对此负责,并称其泄露的数据来自 BigQuery 实例,访问方式是使用被盗的 Anodot 身份验证令牌。[5] 其他报道也把 Anodot 这家分析服务提供商列为疑似第三方入口,称攻击者借此触达下游客户数据。[
8][
10][
11]
换句话说,已报道的路径并不是“直接黑进 Zara 结账页面”,而更像是:攻击者获取或滥用第三方有效令牌,再进入相连的云端数据环境,导出其中保存的数据。这也与 Inditex 所说的“事件源自前供应商,而非 Inditex 自身基础设施内部”相吻合。[1][
4][
5]
目前公开信息还不能等同于一份完整的取证报告。BleepingComputer 指出,Inditex 和 Zara 尚未披露事件的全部细节,包括官方确认的完整受影响人数。[5]
同时,ShinyHunters 的具体入侵方式有一部分来自威胁行为者自己的说法和二手安全报道。因此,“被盗 Anodot 令牌进入 BigQuery”应被视为目前最主要的公开报道版本,而不是已经由 Inditex 完整确认的最终技术结论。[5][
8][
10]
关于数据包规模,报道也存在差异:BleepingComputer 和 Daily.dev 提到 140GB 数据包,而 Cork Safety Alerts 引述 ShinyHunters 的说法称,来自 BigQuery 云实例的数据为 192GB。[5][
10][
11] 对个人用户而言,更有参考价值的仍是 Have I Been Pwned 所列的记录数量:约 197,400 条受影响记录。[
4][
5][
10]
如果你怀疑自己的邮箱可能在这批数据中,接下来一段时间要把所有“Zara 相关通知”都多看一眼。不要直接点击邮件或短信里的链接,尤其是声称退款、重新配送、支付失败、优惠奖励或客服处理进度的内容;更稳妥的做法是手动打开 Zara 官网或官方 App 查看。
对企业安全团队来说,报道中提到的“令牌 + 云数据仓库”路径并不陌生:及时撤销前供应商权限、轮换身份验证令牌、限制云仓库访问范围、监控异常导出、审计谁能访问客户数据集,都是需要长期执行的基本功。[5][
8][
10]
结论很清楚:Zara 这次外泄的数据范围,按目前报道看窄于密码或支付卡泄露;但这些信息已经足够被用于更精准的诈骗。真正值得警惕的,不只是泄露了什么,还包括一个第三方连接如何让全球零售品牌的客户数据变得可被触达。[4][
5][
10]
Inditex confirmed roughly 197,000 Zara customer records were exposed via Anodot, an Israeli AI analytics platform compromised by ShinyHunters. The crew used stolen authentication tokens to pivot into BigQuery instances of multiple downstream customers, haul...
Hackers breached databases of a former technology provider used by Zara (Inditex), exposing data of 197,400 people including email addresses, geographic locations, purchases, and support tickets. The ShinyHunters extortion gang claimed responsibility, alleg...
A series of new entries on a dark web leak site linked to the hacking group ShinyHunters has named Zara, Udemy and 7-Eleven, with stolen data now circulating online. ... In each case, ShinyHunters states that negotiations with the companies failed before th...
Inditex, the owner of Zara, has disclosed a data breach linked to a former technology provider, stating that no customer data was exposed. However, the ShinyHunters extortion group has since listed Zara on its leak site, claiming it will publish stolen data...