Luxury brand Chanel faces a major data breach. Hackers accessed customer names, phone numbers, addresses, and emails through a third-party vendor in the US. Scammers may exploit this info. Find out what Chanel is doing and how you can protect yourself.
Chanel Data Breach: Were You Affected?
Many have bought Chanel’s luxury products online—but now, some U.S. customers’ personal details, including names and contacts, were stolen in a cyberattack.
The incident was first reported by fashion news site Women’s Wear Daily (WWD) on July 25, 2025. During its investigation, Chanel discovered that hackers gained access through a third-party vendor and stole customer data stored in Salesforce’s cloud system. Although the breach didn’t include credit card or password information, the exposed contact details could still be used for scams, spam, or social engineering attacks.
Chanel has confirmed that only a portion of its US customers were affected. Consumers in Taiwan and other regions were not impacted. The company has already notified those affected and is working closely with cybersecurity experts to investigate further and strengthen security measures.
This breach raises important questions: If a global luxury giant like Chanel can be targeted by hackers despite ample resources, what does that mean for other companies? And most importantly—how can we better protect our personal information?
So How Did the Breach Happen? It Wasn’t Chanel’s Own Systems
Surprisingly, the breach didn’t come from a failure within Chanel’s internal systems. Instead, it was linked to one of their third-party vendors—the company responsible for storing customer data. Chanel uses Salesforce, a popular cloud-based platform, and hackers targeted this type of infrastructure.
The attackers used a method called vishing (voice phishing), posing as someone trustworthy over the phone to trick employees into giving up login credentials. In some cases, they convinced users to grant access to malicious OAuth apps, allowing the hackers to infiltrate Salesforce portals and extract data from the backend.
This social engineering attack tricks employees into handing over access—no password hacking needed.
What’s even more concerning? Chanel wasn’t the only company affected. This wave of attacks also hit other major brands using Salesforce, including Qantas Airways, Louis Vuitton, Adidas, and more. The hacker group behind it, known as ShinyHunters, has a history of breaching high-profile companies, collecting vast amounts of user data to sell or pass on to scam networks.
Salesforce responded with a statement:
“Salesforce has not been compromised, and the issues described are not due to any known vulnerability in our platform. While Salesforce builds enterprise-grade security into everything we do, customers also play a critical role in keeping their data safe — especially amid a rise in sophisticated phishing and social engineering attacks”
This incident highlights an important reality: cybersecurity is no longer just about your own defenses—it’s about your entire supply chain. If even one partner in that chain has weak security, it can become an entry point for attackers.
Are You a Chanel Customer? Protect Yourself with These Simple Steps
Chanel has stated that only some U.S. customers were affected by the breach. However, if you’ve ever registered as a member, made a purchase online, or subscribed to Chanel newsletters or customer service emails, it is wise to take a few precautions now:
1. Watch Out for Phishing Messages or Suspicious Calls
Hackers often use leaked data to impersonate official brands. You might receive an email that looks like it’s from Chanel, warning you of an account issue and asking you to click a link or provide credit card details. This is a classic phishing attempt.
Before clicking anything, double-check the sender’s email address and avoid opening links from unknown or suspicious sources.
2. Use a Data Breach Checker
You can use free tools such as Have I Been Pwned to check whether your email address has been exposed in a breach.
If your info has been leaked—don’t panic. Just take action:
- Change your password immediately
- Enable two-factor authentication (2FA) to better protect your accounts
Taking these simple steps can significantly reduce the risk of identity theft or account hijacking.
A Wake-Up Call for Businesses: Here’s How to Boost Your Cybersecurity Now
If you’re a business owner, brand manager, or run an online platform that handles customer accounts or orders, the Chanel incident should serve as a wake-up call . Data breaches don’t just affect big brands—they can hit anyone.
Here are three practical, high-impact cybersecurity steps that every business should take:
✅ 1. Require Multi-Factor Authentication (MFA) for All Accounts
Relying on passwords alone is no longer enough. Hackers are skilled at guessing or phishing for credentials.
By enabling multi-factor authentication (MFA)—such as SMS codes, app-based verification, or biometrics—you add an extra layer of protection. Even if a password is compromised, MFA significantly reduces the risk of unauthorized access.
✅ 2. Apply the Principle of Least Privilege
Not every employee needs access to every dataset.
Limit access based on roles—ensure employees can only view or edit the data they need for their job. This reduces the damage in case of insider threats or compromised accounts, and minimizes the risk of large-scale data leaks.
✅ 3. Adopt Zero Trust Network Access
Zero Trust is a modern cybersecurity framework built on the idea that no one—inside or outside the company—should be automatically trusted. Its core principles include:
- Never trust devices, users, or applications by default
- Require identity verification, behavior analysis, and risk assessment for each access attempt
- Grant access dynamically based on current risk level
This means even internal staff, outsourced teams, and vendors must go through multiple layers of verification and operate under restricted permissions. It prevents attackers from moving laterally across your network if one account is compromised through social engineering or phishing.
Keypasco ZTNA is a cybersecurity solution built on Zero Trust Network Access principles. Developed in line with U.S. NIST and CISA standards, as well as Taiwan’s government Zero Trust framework, it is certified by the National Institute of Cyber Security. Keypasco ZTNA employs identity verification, device authentication, and trust inference technologies to help organizations achieve comprehensive and robust cybersecurity protection.
- Identity Verification: Offers multi-factor authentication, including FIDO U2F and FIDO2 solutions.
- Device Authentication: Scans device attributes and software information, storing them on Keypasco servers for device validation.
- Trust Inference: Uses artificial intelligence to analyze behavior, continuously assess risk, and trigger additional authentication when needed.
Keypasco meets global standards and is trusted by government, finance, healthcare, smart building, and high-tech organizations worldwide. As cyber threats evolve, we remain committed to empowering organizations with robust, future-ready security solutions. This ensures that they stay compliant, resilient, and ahead of the curve in a rapidly changing digital landscape.
English 
Japanese