Rituals: customer personal data leaked after a cyberattack

On 22 April 2026, Rituals — the Amsterdam-based international retailer of cosmetics, home fragrances and wellness products — confirmed that customer personal data had been stolen from its loyalty membership database following a cyberattack. The company notified affected customers by email and warned them to stay alert for fraudulent messages impersonating the brand.

Rituals said it had identified an "unauthorised download" of My Rituals membership data. It did not disclose the technical nature of the attack, and an investigation was underway to determine how the breach occurred. The company stated it acted immediately to stop the access and, at the time of disclosure, had found no evidence that the stolen information had been published online.

The exposed data included:

• Full name
• Date of birth
• Gender
• Postal address
• Email address
• Phone number
• Preferred Rituals store and account type

Rituals stressed that no passwords or payment information were accessed. The company did not disclose how many individuals were affected, citing security reasons; its membership programme spans more than 41 million customers across Europe, the UK and the United States. Because the exposed fields allow detailed customer profiling, Rituals urged members to be wary of phishing emails, fake promotions and other social-engineering attempts that mimic the brand.