Hackers Upload Luxury Eyewear Customer Data to the Dark Web
Cyber attacks and data breaches in the past have been investigated, patched, and forgotten, but the data stolen will always remain in the hands of threat actors….
Sometime between the 30th of April and the 12th of May, over 70 million customers of Luxottica, an eyewear designer and manufacturer with popular proprietary brands including Ray-Ban, Chanel, OPSM, Ferrari and more, had their private information leaked for free online last month. A statement from Luxottica to Bleepingcomputer confirmed the data to be legitimate and first been made aware of the stolen data in November of 2022; originally for private sale on a hacking forum.
“We first learned of the incident from a third-party post on the dark web in November 2022.” said a representative of Luxottica
Image of first appearance of Luxottica data breach from 'Breached.com' forumData stolen contained dates of birth, gender identities, emails, phone numbers, street addresses, and last names of Luxottica customers cumulating to a staggering 306,090,199 records, confirmed to be owned to exactly 77,093,812 customer accounts. Our investigation team then confirmed with the available data that not only the US and Canadian customers were affected, but Australian consumers as well. D3Lab’s leading researcher of the Italian cybersecurity firm, Andrea Draghetti, later confirmed that 74% of the compromised Luxottica customers were involved in a data breach that took place in 2020 involving a ransomware gang called “Netfilm” with the other 26% of customer data stolen on a separate data breach that took place on the 16th of March 2021.
Andrea Draghetti post from TwitterLuxottica also responded to Bleepingcomputer on the current ongoing investigation with the resurfacing of the 2021 stolen data.
“We discovered through our proactive monitoring procedures that certain retail customer data, allegedly obtained through a third-party related to Luxottica retail customers, was published in an online post.
We immediately reported the incident to the FBI and the Italian Police. The owner of the website where the data was posted has been arrested by the FBI, the website was shut down and the investigation is ongoing. The Italian data protection authority has also been notified and we are considering other notification obligations.
From our investigation, which is still going on, we know so far that the data primarily consists of customer contact details including names, addresses, phone numbers, emails and dates of birth. The data does not include individuals’ financial information, social security numbers, login or password data or other information that would compromise the safety of our customers.
EssilorLuxottica remains confident that its systems were not breached and its network remains secure.”
This is Part of our Cyber Security awareness educational campaign. Through this training, you will learn awareness and key principles, and best practices to protect yourself, your organisation, and the public from cyber attackers. You will also be equipped with the knowledge to identify potential threats and take action before any damage can occur.