Zara Breach: ShinyHunters Leveraged Anodot Compromise for Extortion

In April 2026, the fashion giant Zara was targeted by the ShinyHunters extortion group, part of a broader “pay or leak” campaign. Have I Been Pwned reports that the attackers claimed the breach originated from a compromise of the Anodot analytics platform. This led to the publication of a terabyte of data, allegedly containing 95 million support ticket records.

The compromised data, according to Have I Been Pwned, included approximately 197,000 unique email addresses. Alongside these emails were product SKUs, order IDs, and the market where the support tickets originated. Zara’s parent company, Inditex, confirmed that the incident did not expose customer passwords or payment information.

This incident underscores the critical risk posed by third-party vendor compromises. Attackers are increasingly leveraging supply chain vulnerabilities, like a compromised analytics platform, to gain access to sensitive customer data from downstream organizations. Even without direct password or payment data, the collection of email addresses, order details, and support interactions provides valuable intelligence for phishing, social engineering, and identity theft.