Luxury retailer Louis Vuitton has suffered a cyber-attack that resulted in the exfiltration of certain personal data of customers from the UK, South Korea, Turkey, Italy, and Sweden

Luxury fashion giant Louis Vuitton has confirmed a significant cyberattack that resulted in the exfiltration of personal data belonging to customers in the UK, South Korea, Turkey, Italy, and Sweden. While the company assures that no payment information was compromised, the breach exposed sensitive client data, raising concerns about potential phishing attempts and identity fraud.

The luxury brand, a flagship of the LVMH Moët Hennessy Louis Vuitton conglomerate, became aware of unauthorized access to its systems on July 2, 2025. Investigations are ongoing, but sources indicate that the notorious ShinyHunters extortion group is believed to be responsible for the attack, possibly gaining access through a compromised third-party vendor’s database. This modus operandi aligns with recent tactics employed by the group in other high-profile data theft campaigns.

Affected customers have begun receiving notifications from Louis Vuitton, detailing the scope of the exposed information, which reportedly includes names, contact details, and purchase histories. In Turkey alone, over 143,000 residents were impacted. The company has emphasized that financial details such as credit card numbers and passwords were not part of the exfiltrated data.

This incident marks the latest in a series of cyberattacks targeting luxury retailers and other LVMH brands in recent months, including Christian Dior Couture and Tiffany & Co., both of which also saw customer data compromised, particularly in South Korea. The recurring nature of these breaches highlights a growing vulnerability within the luxury sector, where valuable customer data and brand reputation are prime targets for cybercriminals.

Louis Vuitton states its cybersecurity teams took immediate measures to contain the incident and block unauthorized access. The company is collaborating with cybersecurity experts to further investigate and is actively notifying relevant regulatory authorities, including the UK Information Commissioner’s Office (ICO).

Customers in the affected regions are advised to remain vigilant against unexpected communications, particularly those soliciting personal or financial information, and to be wary of any suspicious contact that might attempt to leverage the exposed data for fraudulent purposes. The breach underscores the critical need for enhanced cybersecurity measures across all sectors, especially those handling large volumes of personal consumer data.