Ralph Lauren Data Breach (June 2026)
Fashion retailer Ralph Lauren was targeted in a ShinyHunters pay or leak extortion campaign in June 2026, and Have I Been Pwned has verified 139,903 email addresses from the data the group published, along with names, phone numbers, genders and age groups.
- Organization
- Ralph Lauren
- Sector
- Retail
- Country
- United States, NY
- Incident date
- June 11, 2026
- Disclosed
- June 18, 2026
- Records affected
- 140,000
- Attack type
- Undisclosed
- Threat actor
- ShinyHunters
- Status
- Confirmed
- Age groups
- Email addresses
- Genders
- Names
- Phone numbers
- ShinyHunters lists Ralph Lauren Corporation on its leak site, per ransomware.live's record of the listing, and Cybernews reports the claim the same day. Have I Been Pwned records this as the breach date.
- The deadline the group's June 11 listing gives Ralph Lauren to make contact before the data is leaked, per ransomware.live's record of the listing.
- ShinyHunters posts an updated listing for Ralph Lauren that gives a size of 163GB+ compressed, per ransomware.live.
- Have I Been Pwned adds the breach, covering 139,903 unique email addresses, per its entry.
What Happened
Per the Have I Been Pwned entry, fashion retailer Ralph Lauren was targeted in June 2026 in a ShinyHunters pay or leak extortion campaign, and the group went on to publish hundreds of gigabytes of data that it claimed was obtained from Ralph Lauren's Salesforce instance. Have I Been Pwned counts 139,903 unique email addresses in that data, along with names, phone numbers, genders and age groups.
The group listed Ralph Lauren Corporation on its leak site on June 11, 2026, according to ransomware.live's record of the listing. The listing claims over 220GB of data containing customer personally identifiable information, purchase and transaction information and details of releases planned from 2027 onward, and it gave the company until June 14, 2026 to make contact before the data was leaked. Cybernews reported the claim the same day, noting that the group's post included no data sample and that Cybernews had asked Ralph Lauren for comment.
ShinyHunters posted an updated listing for Ralph Lauren on June 16, 2026 that gives a size of 163GB+ compressed, according to ransomware.live. Have I Been Pwned added the data on June 18, 2026, and TechNadu reported the load on June 19, 2026.
What Was Exposed
5 classes of data across 139,903 records, per Have I Been Pwned, Ralph Lauren breach entry: age groups, email addresses, genders, names and phone numbers.
A name, email address and phone number tied to a gender and an age group is enough to send a fake Ralph Lauren offer or order alert, by email or by text, that looks tailored to the person receiving it.
What to Do If You Are Affected
The full sequence, and what to do in what order, is in what to do after a data breach.
What Is Not Known Yet
How the group got access, whether the data came from Ralph Lauren's Salesforce instance as the group claims, and whether Ralph Lauren is notifying the people in the data.
Sources
- Have I Been Pwned, Ralph Lauren breach entry
- Cybernews, "Hacker group boasts about Ralph Lauren data breach: 220GB allegedly stolen", June 11, 2026
- TechNadu, "140,000 Records Leaked in Ralph Lauren ShinyHunters Salesforce Breach", June 19, 2026
- Ransomware.live, ShinyHunters listing for Ralph Lauren Corporation, June 11, 2026
- Ransomware.live, updated ShinyHunters listing for Ralph Lauren, June 16, 2026
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.