Leak at Kiabi

On 14 January 2025, Kiabi — a major French clothing retailer — disclosed that its secondhand resale site, secondemain.kiabi.com, had been hit by a credential-stuffing attack detected on 7 January. The attackers used login/password pairs leaked in unrelated breaches to break into customer accounts on the platform en masse via automated bots.

By gaining access to the accounts, the criminals were able to harvest personal and partial banking information for roughly 20,000 customers. The breach was confined to the secondhand site and did not affect Kiabi's main e-commerce platform.

The exposed data included:

• Last name and first name
• Date of birth
• Postal address and contact details
• IBAN (where customers had registered one)

Kiabi stated that full bank details (RIB) and identity documents were not compromised, as those are held by its payment partner Lemonway and are not accessible from customer accounts. In response, the company masked IBANs in customer accounts, forced a reset of all customer passwords, and raised the minimum password length to 14 characters. The same wave of credential-stuffing attacks was linked by researchers to a similar incident at Showroomprivé days earlier.