Ransomware victim disclosure
← All victimsZara (zara.com)
Claimed by shinyhunters · listed 1 month ago
Status timeline
- Listed
Apr 19, 2026
- Data leaked
At a glance
- Group
- shinyhunters
- Status
- Data leaked
- Country
- ES
- Sector
- Consumer Services
- Listed on leak site
- Apr 19, 2026
About the victim
AI dossier — public-source company profileZara is a flagship fast-fashion retail brand owned by Inditex, headquartered in Arteixo (A Coruña), Spain. It operates thousands of stores across more than 90 countries and is one of the world's largest clothing retailers. Zara is known for its rapid design-to-shelf supply chain and significant e-commerce presence via zara.com.
- Industry
- Fast Fashion & Apparel Retail
- Address
- Calle Txingudi 4, 15703 Santiago de Compostela (A Coruña), Galicia, Spain
- Employees
- 10000+
- Founded
- 1975
Attack summary
Severity: high — A confirmed supply-chain intrusion via a third-party vendor (Anodot) resulting in exfiltration of cloud data warehouse (BigQuery) contents from a global retailer of this scale is significant; BigQuery instances for a major e-commerce company likely contain large volumes of customer PII and transactional data, but no regulated medical or government data is indicated, keeping it at high rather than critical pending confirmation of data types.ShinyHunters claims to have exfiltrated data from Zara's Google BigQuery cloud instances, reportedly gained via a compromise of third-party analytics vendor Anodot.com, and is threatening to publish the data along with additional 'digital problems' if payment is not received by 21 April 2026.
Data the group says was taken
AI dossier — extracted from the leak post- BigQuery database contents
- Cloud analytics data
- Potentially customer/transactional records (inferred from BigQuery usage)
What the group claims
Your Bigquery instances data was compromised thanks to Anodot.com. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 18 Apr 2026 | Warning: FINAL WARNING PAY OR LEAK
Sources
- Victim sitezara.com
Source
Indexed 1 month agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
