約 197,400 筆 Zara 顧客紀錄據報受影響,內容包括電子郵件、地區或市場資訊、購買/訂單資料與客服工單;Inditex 表示密碼與支付卡資料未被存取。 安全報導將事件與 ShinyHunters 連結,指其疑似利用遭竊的 Anodot 驗證權杖存取 BigQuery 資料;但 Inditex 尚未公布完整技術調查報告。

Create a landscape editorial hero image for this Studio Global article: What personal data was exposed in the Zara third-party breach, and how did ShinyHunters gain access to it?. Article summary: The exposed Zara data reportedly included about 197,400 customer records, mainly email addresses, geographic/location market data, purchase/order information, and support-ticket data. ShinyHunters appears to have accesse. Topic tags: general, general web. Reference image context from search candidates: Reference image 1: visual subject "# Zara Data Breach Exposed Personal Information of 197,000 People. Have I Been Pwned has confirmed that a data breach at Spanish fast-fashion retailer Zara exposed the personal inf" source context "Zara Data Breach Exposed Personal Information of 197,000 People" Reference image 2: visual subject "# Zara Data Breach Exposed Personal Information of 197,000 People.
這起 Zara 資料外洩,重點不在於「Zara 結帳頁被攻破」,而是第三方資料曝險。Zara 母公司 Inditex 將事件歸因於一名前技術供應商遭未授權存取;外洩通報服務 Have I Been Pwned 與多家資安報導則指出,受影響人數約為 197,400 人。 [1][
4][
5]
目前公開資訊顯示,外洩資料不包含密碼與支付卡資料;但資料內容仍足以讓詐騙訊息變得更像真的,例如冒充 Zara 訂單、退費或客服通知。 [4][
10]
Have I Been Pwned 將 Zara 事件列為影響超過 197,000 人;多篇報導進一步列出約 197,400 筆紀錄。 [4]
Studio Global AI
Use this topic as a starting point for a fresh source-backed answer, then compare citations before you share it.
約 197,400 筆 Zara 顧客紀錄據報受影響,內容包括電子郵件、地區或市場資訊、購買/訂單資料與客服工單;Inditex 表示密碼與支付卡資料未被存取。
約 197,400 筆 Zara 顧客紀錄據報受影響,內容包括電子郵件、地區或市場資訊、購買/訂單資料與客服工單;Inditex 表示密碼與支付卡資料未被存取。 安全報導將事件與 ShinyHunters 連結,指其疑似利用遭竊的 Anodot 驗證權杖存取 BigQuery 資料;但 Inditex 尚未公布完整技術調查報告。
繼續閱讀「NACHO 交易是什麼?華爾街押注霍爾木茲海峽「不會快開」」,從另一個角度查看更多引用來源。
開啟相關頁面將這個答案與「Big Tech 為 AI 蓋「重資產底盤」:債券市場成新戰場」交叉比對。
開啟相關頁面Inditex, the Spanish retail giant behind Zara, has confirmed a data breach that exposed the personal information of 197,000 people. The breach did not originate inside Inditex's own systems. Instead, it traced back to a former third-party technology provide...
Inditex confirmed unauthorized access tied to a former technology provider, and Have I Been Pwned says 197,400 people were affected . The good news: Inditex says key data like passwords and payment card info wasn’t accessed . The bad news: the leaked detail...
Hackers who gained access to the databases of Spanish fast-fashion retailer Zara stole data belonging to more than 197,000 customers, according to data breach notification service Have I Been Pwned. ... While Inditex and Zara have yet to disclose more deta...
On May 8, 2026, the breach notification service Have I Been Pwned added Zara to its database, formalizing what ShinyHunters had been threatening for weeks. The dataset that ended up on the leak portal contained 197,400 unique email addresses tied to Zara cu...
據目前報導,外洩欄位包括:
這些資料看似不像信用卡號那樣「一眼高風險」,但對詐騙者很有用。若攻擊者能在郵件中寫出你的真實電郵、購買市場、訂單編號、商品或客服互動內容,釣魚訊息就更容易取得信任。Cloaked 的分析也提醒,即使沒有密碼或卡號,這類細節仍可能被用於釣魚與帳號接管嘗試。 [4]
Inditex 據報表示,密碼與支付卡資訊未被存取。 [4] Daily.dev 的整理也稱,姓名、電話號碼、地址、登入憑證與付款資料未遭外洩;不過,這仍應與另一個前提一起看:Inditex 尚未公開完整的技術細節與鑑識報告。 [
5][
10]
後續資安報導把事件與勒索組織 ShinyHunters 連結起來。BleepingComputer 報導稱,ShinyHunters 聲稱對事件負責,並外洩一份 140GB 檔案;該檔案據稱來自 BigQuery 執行個體,攻擊者使用的是遭入侵的 Anodot 驗證權杖。 [5] 其他報導也將 Anodot 這家分析服務供應商列為疑似第三方路徑,指向下游客戶資料被接觸的可能性。 [
8][
10][
11]
用白話說,報導中的攻擊路徑比較像是:攻擊者取得或濫用第三方驗證權杖,透過這些有效憑證進入相連的雲端資料環境,再匯出其中資料;而不是直接攻破 Zara 的購物車或付款頁。這也與 Inditex 指稱事件來自前供應商、而非自家基礎設施內部遭入侵的說法相符。 [1][
4][
5]
公開資訊仍未達到完整鑑識報告的程度。BleepingComputer 指出,Inditex 與 Zara 尚未揭露事件的所有細節,包括官方確認的完整受影響人數。 [5]
ShinyHunters 的具體入侵方式,也有一部分來自威脅行為者自身說法與二手資安報導;因此,應把「遭竊 Anodot 權杖存取 BigQuery」視為目前最主要的報導版本,而不是已由官方完整確認的技術結論。 [5][
8][
10]
各方對外洩壓縮包大小的說法也不完全一致:BleepingComputer 與 Daily.dev 提到 140GB;Cork Safety Alerts 則報導 ShinyHunters 宣稱從 BigQuery 雲端執行個體取得 192GB 資料。 [5][
10][
11] 對個別顧客而言,更有參考價值的數字仍是 Have I Been Pwned 所列的紀錄數:約 197,400 筆。 [
4][
5][
10]
如果你的電子郵件可能出現在這批資料中,接下來一段時間要特別留意任何自稱來自 Zara 的訊息。不要直接點擊郵件或簡訊中的退款、配送問題、付款失敗、會員獎勵或客服案件連結;比較安全的做法是自行打開 Zara 官方網站或 App 查詢。
由於目前報導稱密碼與支付卡資料未被存取,單就已知事實來看,大規模更換信用卡並不是最明顯的第一步。 [4][
10] 但如果你曾在 Zara 或其他零售帳號重複使用同一組密碼,仍應立即更換;可用多因素驗證的服務,也應盡量開啟。
對企業資安團隊來說,報導中的「權杖+資料倉儲」路徑也指向幾項老問題:離職或停用供應商的存取權是否真的撤銷?驗證權杖是否定期輪替?雲端資料倉儲權限是否過大?異常大量匯出是否會被監控?誰能接觸顧客資料集,是否有定期稽核? [5][
8][
10]
結論是:Zara 這次外洩的資料,從目前報導看來沒有密碼或支付卡那麼敏感;但它仍足夠個人化,足以被拿來做更有說服力的詐騙。真正值得警惕的,不只是外洩了什麼,而是第三方連線如何讓全球零售品牌的顧客資料變得可被接觸。 [4][
5][
10]
Inditex confirmed roughly 197,000 Zara customer records were exposed via Anodot, an Israeli AI analytics platform compromised by ShinyHunters. The crew used stolen authentication tokens to pivot into BigQuery instances of multiple downstream customers, haul...
Hackers breached databases of a former technology provider used by Zara (Inditex), exposing data of 197,400 people including email addresses, geographic locations, purchases, and support tickets. The ShinyHunters extortion gang claimed responsibility, alleg...
A series of new entries on a dark web leak site linked to the hacking group ShinyHunters has named Zara, Udemy and 7-Eleven, with stolen data now circulating online. ... In each case, ShinyHunters states that negotiations with the companies failed before th...
Inditex, the owner of Zara, has disclosed a data breach linked to a former technology provider, stating that no customer data was exposed. However, the ShinyHunters extortion group has since listed Zara on its leak site, claiming it will publish stolen data...