Breach Disclosure: Sephora

On or around July 29, 2019, cosmetic giant Sephora reported a data breach. This breach affects customers in Southeast Asia, and ANZ who have used Sephora's online services. Exposed data includes full name, date of birth, gender, email, encrypted data, and data related to customer product preferences.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

In late July 2019, Sephora reported a data breach affecting customers in Singapore, Malaysia, Indonesia, Thailand, Philippines, Hong Kong SAR, Australia, and New Zealand. Leaked information includes full name, date of birth, gender, email, encrypted data, and data related to customer product preferences.

No payment information appears to have been accessed. At this time, Sephora believes no personal information has been abused, and has notified affected customers. Sephora is also offering customers a personal data monitoring service at no charge.