Mytheresa Data Breach (2026): What Was Exposed & What To Do

In April 2026, the luxury fashion e-commerce platform Mytheresa was listed as a victim of the ShinyHunters extortion group. After a ransom deadline passed, the group publicly released data containing 84,000 unique email addresses along with names, phone numbers, physical addresses, purchases, salutations and partial credit card information. The incident was reported on 12 April 2026. Public detail on how the data was obtained remains limited.

Breaking down the breach

The available information states that Mytheresa appeared on a list associated with ShinyHunters. The group then released the data after the deadline for payment expired. The release is reported to include 84,000 unique email addresses together with the additional fields listed above. No further technical details on the intrusion method, exact timing of access, or confirmation of the data's authenticity beyond the group's listing have been disclosed.

Who is shinyhunters?

ShinyHunters is a threat actor publicly known for targeting organisations and demanding payment to prevent the release of stolen data. The group has used a “pay or leak” approach in multiple prior incidents, posting victim names on leak sites and releasing material when deadlines are not met. Its activity has been documented across a range of sectors in open reporting over several years. In this case the group claims responsibility through the listing and subsequent release; independent verification of the full data set has not been detailed in public statements.

Mytheresa and its sector

Mytheresa operates as an online retailer of luxury fashion and related goods. Companies in this sector routinely collect and store customer records to process orders, manage accounts and handle deliveries. Such records commonly include contact details, transaction histories and limited payment information. A breach affecting these systems can expose data that customers provide when making purchases, though the precise scope and sensitivity of any individual record varies.

The information in question

The reported release includes email addresses, names, phone numbers, physical addresses, purchases, salutations and partial credit card data consisting of card type, last four digits and expiry date. The exact contents of every record and whether additional fields were present have not been independently confirmed beyond the summary provided. Organisations of this type typically hold similar categories of customer information, but the specific composition of the released set remains unverified in detail.

Why it matters

Exposure of email addresses and purchase histories can enable targeted phishing or unwanted contact. Partial card details combined with names and addresses may assist in attempts at account takeover or fraud, although the absence of full card numbers limits immediate use for direct payments. For the organisation, the incident adds to the record of known data exposures in the luxury retail sector and may prompt reviews of access controls and retention practices. Affected individuals face the practical task of monitoring accounts and communications for unusual activity.

Were you affected?

Individuals can check whether their email address appears in known breach data by using a free exposure scan service. Practical steps include reviewing recent account activity on Mytheresa and any linked payment methods, enabling multi-factor authentication where available, and remaining alert for unsolicited messages that reference the exposed details. Organisations recommend changing passwords if the same credentials are used elsewhere.

AICompiled with AI assistance from public sources and published under our editorial standards.