Loading story…
South Korea’s Personal Information Protection Commission (PIPC) fined the Korean subsidiaries of Louis Vuitton, Christian Dior Couture, and Tiffany a combined KRW 36.033 billion (~$25M), with additional penalties, after customer data was exposed through unauthorized access to a cloud-based customer management SaaS platform widely reported as Salesforce. The incidents were linked by multiple reports to the ShinyHunters campaign targeting Salesforce environments, and the regulator ordered the companies to publicly post notice of the sanctions on their websites.
PIPC attributed the Louis Vuitton breach to malware on an employee device that enabled theft of SaaS credentials, leading to exposure of data for about 3.6 million individuals across multiple incidents; the regulator cited missing IP-based access restrictions and lack of strong authentication for external access. For Dior and Tiffany, PIPC described voice phishing (vishing)/social engineering of customer service staff that resulted in attackers being granted SaaS access, exposing data for about 1.95 million (Dior) and ~4,600 (Tiffany) individuals; cited control gaps included lack of IP restrictions, insufficient limits on bulk export/download tools, and inadequate log review, and both Dior and Tiffany were also faulted for missing the statutory 72-hour breach notification window. Exposed data was reported to include customer identifiers and contact details (e.g., names, phone numbers, emails, addresses) and purchase history.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
On February 13, 2026, South Korea's Personal Information Protection Commission fined Louis Vuitton Korea, Christian Dior Couture Korea, and Tiffany Korea a combined roughly $25 million (about 36 billion won) for data breaches affecting more than 5.5 million customers. The regulator cited missing IP restrictions, weak authentication, inadequate monitoring and download controls, and ordered the companies to post notices of the fines on their websites.
Reporting and regulator summaries connected the luxury-brand breaches to the ShinyHunters campaign targeting Salesforce environments. The threat actor was also reported to have claimed the LVMH breach.
After recognizing their breaches, both Christian Dior Couture Korea and Tiffany Korea failed to notify authorities within the statutory 72-hour window. Regulators later cited the delayed notifications as separate compliance violations.
Tiffany Korea was also compromised through voice phishing of customer service staff, enabling unauthorized access and bulk downloads from its customer management SaaS. The incident exposed personal data of about 4,600 individuals.
Christian Dior Couture Korea was compromised after customer service representatives were targeted with social engineering and voice phishing, allowing attackers to provision or grant access to the SaaS system. The breach exposed data for about 1.95 million individuals and reportedly went undetected for more than three months.
In mid-June 2025, unauthorized access to Louis Vuitton Korea's SaaS environment led to three leak events exposing personal data of about 3.6 million individuals. Exposed information included customer contact details and related personal data.
Malware on a Louis Vuitton Korea employee device enabled attackers to steal credentials for a cloud-based customer management SaaS platform, setting up the later data exposure. The incident was later linked by reporting to the broader ShinyHunters Salesforce-focused campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcecsoonline.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
South Korean regulators have notified **Lotte Card** that it faces about **5 billion won** in financial penalties and a **business suspension of more than four months** after hackers breached the company’s online payment system and exposed personal information belonging to about **2.97 million customers**. The notice was issued by the **Financial Supervisory Service**, with the **Financial Services Commission** expected to finalize the sanctions. Investigators found that Lotte Card had also failed to apply sufficient encryption to log files, adding to the severity of the case. The action represents a second major penalty tied to the same incident after the country’s data protection watchdog previously imposed an additional **9.62 billion won** fine, underscoring South Korea’s tougher enforcement posture, which can include suspending new customer sign-ups and penalizing executives after major breaches.
Jun 29, 2026
A hacking group known as Scattered LAPSUS$ Hunters publicly released data stolen from the Salesforce environments of multiple companies, including Qantas and Vietnam Airlines. The group had previously threatened to leak data unless Salesforce or the affected companies paid a ransom, but the deadline passed without payment, prompting the attackers to publish data from six of the 39 companies they claimed to have compromised. The initial leaks included data from Qantas, Albertsons, GAP, Vietnam Airlines, Fujifilm, and Engie Resources. Qantas received significant media attention due to a court injunction it obtained in an attempt to prevent the use or dissemination of the stolen data, but the injunction proved ineffective as the data was still widely distributed. The attackers used multiple platforms to share the stolen information, including an onion site, a clear net forum, and a new clear net leak site, making the data accessible to a broad audience. For Vietnam Airlines, the breach resulted in the exposure of 7.5 million unique customer email addresses, along with names, phone numbers, dates of birth, and loyalty program membership numbers. The breach of Vietnam Airlines' Salesforce environment reportedly occurred in June 2025, but the data was not publicly released until October. The group’s leak strategy included charging for access to the data on some platforms, while later making it freely available on others. Despite initial claims of a massive leak affecting 39 companies, only six organizations' data was actually released, leading to speculation about the group’s motives and capabilities. The attackers communicated with followers via Telegram, providing updates and alternative download links when their primary leak site experienced technical issues. The incident highlighted the limitations of legal measures such as injunctions in preventing the spread of stolen data once it is in the hands of threat actors. Media and security experts, including Troy Hunt, provided commentary on the situation, emphasizing the inevitability of the data’s release and the challenges faced by affected organizations. The breach underscores the risks associated with third-party cloud platforms like Salesforce and the importance of robust security controls and incident response plans. Companies affected by the breach were advised to notify impacted customers, recommend password changes, and implement additional security measures such as two-factor authentication. The event also demonstrated the evolving tactics of cybercriminal groups in monetizing and publicizing stolen data, as well as the ongoing threat posed by supply chain and third-party breaches.
Jun 29, 2026
French retailer **LDLC** disclosed a breach affecting customers of its physical stores after stolen data was advertised for sale on a hacking forum. The exposed dataset reportedly included **1.26 million unique email addresses** along with customers' names, phone numbers, and physical addresses, indicating broad exposure of personally identifiable information tied to retail transactions. Emirati retailer **LuLu** also suffered a customer data breach in which an initial set of about **190,000 email addresses** and linked phone numbers was shared on a hacking forum. The incident escalated when the threat actor later leaked a larger backup from **October 2022**, exposing an additional **2.6 million unique email addresses** as well as names, physical addresses, order data, and **`PBKDF2` password hashes**, significantly increasing the risk of account compromise and follow-on phishing or fraud.
Jun 29, 2026