Loading story…
Rituals, the Netherlands-based cosmetics retailer, confirmed that attackers accessed and downloaded data from its My Rituals membership database, exposing customer records across Europe, the United Kingdom, and some customers in the United States. The company said the stolen information may include full names, dates of birth, gender, postal and email addresses, phone numbers, preferred store, and account type, while stating that passwords and payment data were not accessed.
Rituals said it detected the unauthorized downloads in April, blocked the attackers' access, notified relevant authorities, and opened a forensic investigation. The company has not disclosed how the intrusion occurred, how many people were affected, or whether any ransom demand was made, though the loyalty program reportedly has more than 41 million members. Rituals also said it has not found evidence that the stolen data has been leaked online and has not attributed the breach to a known threat actor.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On or before April 22, 2026, Rituals publicly disclosed a breach affecting its customer membership records. The company said customers in Europe, the United Kingdom, and some in the United States were affected, but it did not reveal the total number of impacted individuals or attribute the attack to a threat actor.
After discovering the intrusion in April 2026, Rituals said it blocked the attackers' access, notified relevant authorities, and launched a forensic investigation. The company has not disclosed how the breach occurred and said its investigation remains ongoing.
Earlier in April 2026, Rituals discovered that attackers had conducted unauthorized downloads of customer data from its My Rituals membership database. The company said the compromised data included personal and account-related details, but not passwords or payment information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Basic-Fit, Europe’s largest budget gym chain by club count, disclosed that hackers breached its membership visit-registration system and stole personal data belonging to about 1 million members across several European countries, including roughly 200,000 in the Netherlands. The company said it detected the intrusion and stopped the unauthorized access within minutes, but not before attackers downloaded a substantial volume of customer information from a central system used across multiple countries. The exposed data included names, addresses, email addresses, phone numbers, dates of birth, bank account details, subscription status, and recently visited gym locations. Basic-Fit said passwords and identity documents were not stored in the affected environment and have not been found among the stolen data. The company notified the Dutch Data Protection Authority under GDPR requirements, informed affected members directly, and warned customers to remain alert for phishing attempts while the investigation into the unidentified attackers continues.
Jun 29, 2026
**Eurail B.V.** confirmed that customer data stolen in a previously disclosed breach is now being **offered for sale on the dark web**, with a **sample dataset published on Telegram**. The Netherlands-based rail pass operator (Eurail/Interrail), which also serves travelers in the European Commission’s **DiscoverEU** program, said it is still investigating the scope and impact and has engaged external cybersecurity and legal experts while working to determine which records and how many customers are affected. Reportedly exposed data may include **order and reservation details** and sensitive personal information such as names, dates of birth/age, contact details (email, phone, address, country of residence), travel companion information, and in some cases **passport/ID data (including photocopies), passport numbers and expiry dates**, **bank account references (IBAN)**, and **health-related data**. Eurail said it has notified relevant data protection authorities under **GDPR** and plans to issue individual notifications to impacted customers; it also advised users to be alert for **phishing/scams** and to update passwords (including the *Rail Planner* app) where credentials may have been reused.
Jun 29, 2026
Dutch authorities reported a prolonged compromise at the Dutch prisons agency **DJI**, where attackers reportedly maintained access for at least **five months**. Exposed information included staff **email addresses, phone numbers, and security certificates**, and the Dutch NCSC indicated the intruders also accessed **phones, tablets, and laptops**, though the extent of data access on those endpoints was not confirmed; DJI did not confirm whether access had been fully removed. Separately, Dutch telecom **Odido** disclosed a **data breach followed by an extortion attempt**, after which attackers publicly released about **1M records** (including **317k unique email addresses**) and threatened additional leaks. The published data reportedly included **names, physical addresses, phone numbers, bank account numbers**, and customer-service notes; Odido’s notice also warned that **dates of birth** and government ID numbers (passport/driver’s license) were impacted. A **Canadian Tire** breach entry describes a different incident in Canada (October 2025) involving ~**42M records** with PBKDF2-hashed passwords and some partial payment-card metadata, and is not part of the Netherlands-focused events above.
Jun 29, 2026