French luxury conglomerate Kering confirmed Monday that hackers accessed customer data from several of its high-end brands, including Gucci, Balenciaga, and Alexander McQueen, potentially affecting 7.4 million customers worldwide. The cybercriminals, identified as the notorious ShinyHunters group, stole names, email addresses, phone numbers, home addresses, and detailed spending records showing individual purchase amounts ranging from thousands to over $80,000.The Paris-based company, which discovered the breach in June, said no financial information including credit card details or bank account numbers was compromised. Kering has notified affected customers and relevant data protection authorities across multiple countries, though it declined to specify which regions were impacted.

Luxury brands have been on target of hackers recently

The Kering incident represents the latest in a wave of cyberattacks targeting luxury brands throughout 2025. The breach occurred in April during a period when hackers also successfully targeted other premium retailers, including Cartier owner Richemont and LVMH brands like Louis Vuitton, which suffered a separate data leak affecting 419,000 customers.ShinyHunters, communicating through encrypted messaging app Telegram, claimed responsibility for the attack and allegedly attempted to extort Kering for ransom payments in Bitcoin. The company denied engaging in any negotiations with the criminals, following law enforcement guidance against paying ransoms.The stolen data poses particular risks for high-spending customers, as detailed purchase histories could make them targets for secondary scams and sophisticated social engineering attacks. Some customer records analyzed showed spending patterns exceeding $30,000 across individual luxury brands.Cybersecurity experts at Google previously warned about ShinyHunters’ tactics, which typically involve tricking employees into revealing login credentials for internal systems. The group, also known as UNC6040 by security researchers, has expanded operations significantly, even successfully breaching Google’s own systems earlier this year.