Leak at Mango

On 15 October 2025, Mango — the Spanish fast-fashion retailer — began notifying customers that personal data used in its marketing campaigns had been exposed in a data breach. The compromise did not affect Mango's own systems or corporate infrastructure: instead, an external service provider handling the brand's marketing campaigns suffered unauthorized access to customer data, making this a supply-chain incident.

The data involved was limited to contact and demographic fields. Exposed categories included:

• First name
• Country
• Postal code
• Email address
• Phone number

According to Mango and to ZATAZ, no surnames, passwords, login credentials, banking or credit-card details, or identity-document data were involved. The company did not disclose how many customers were affected; figures circulating in aggregator listings are unverified.

Mango said it activated its security protocols on detecting the incident over the weekend and notified the Spanish data protection authority (AEPD) within the timeframes required under the GDPR. It set up a dedicated contact channel (personaldata@mango.com) for concerned customers and urged vigilance against phishing emails and suspicious phone calls. The retailer stated that its systems continued to operate normally, placing the incident among a wave of 2025 attacks on the retail sector.