Leak at Dior

On 13 May 2025, Dior — the Christian Dior Couture luxury fashion house, part of the LVMH group — began notifying customers that an unauthorized third party had accessed some of their personal data. The alerts first reached clients in Asia, notably China and South Korea, before the breach was disclosed more widely.

Dior discovered the intrusion on 7 May 2025. According to subsequent reporting the underlying compromise dated back to 26 January 2025, leaving the attacker undetected for more than three months. The access was attributed in press coverage to the ShinyHunters extortion group, which reached the customer data through a compromised database rather than Dior's payment systems.

Exposed data categories included:

• Full names
• Email and postal addresses
• Telephone numbers
• Purchase history and marketing preferences

Dior stressed that no banking or financial data — payment-card numbers, IBANs or similar — was held in the affected database. The company said it had contained the incident, engaged external cybersecurity specialists and notified the relevant authorities; affected customers in some regions were later offered complimentary credit-monitoring and identity-theft protection. The breach drew regulatory scrutiny, including in China and South Korea, given the volume of personal data involved.