Tiffany, Dior suffer data breaches — and report them weeks later

LVMH Moët Hennessy – Louis Vuitton Chairman and CEO Bernard Arnault is pictured before the start of the Formula One Grand Prix of Monaco at the Circuit de Monaco in Monte Carlo on May 25. [EPA/YONHAP]

 
Multiple data breaches have recently occurred at luxury brands under LVMH, the world’s largest luxury conglomerate, raising concerns among consumers regarding the group’s data security practices.
 
Tiffany & Company Korea said Monday that it company had become aware on May 9 that personal information belonging to Korea-based customers — including names, addresses, phone numbers, email addresses and sales data — had been compromised. The breach originally occurred on April 8 but was not identified until a month later.
 
 
Tiffany & Company Korea stated that there has been no evidence of misuse or abuse of the leaked data.
 
The company has not publicly disclosed the breach on its website.
 
“We informed only affected customers via email,” a customer service representative said. “Suspicious activity was detected on a third-party application managing global customer data, and our headquarters’ security team has completed technical and legal countermeasures.” They added that no financial information, such as payment card data, was involved.
 
A similar incident occurred at Dior, another French luxury brand under LVMH. On May 13, Dior posted a notice on its website about a data leak that included customer names, phone numbers, email addresses and purchase records.
 
Dior detected the breach long after it had taken place. The information was leaked on Jan. 26, but the breach was not discovered until May 7 — roughly 100 days later. The company then waited six more days before notifying customers via email and its website, prompting criticism of the delayed response. Under Korea’s Information and Communications Network Act, companies must notify the Korea Internet & Security Agency or the Ministry of Science and ICT within 24 hours of confirming a data leak. Dior reported the incident on May 10, three days after discovering the breach, drawing further scrutiny.
 
Online communities have been filled with expressions of anxiety.
 
“Even if it’s just names, emails and phone numbers, it still feels scary and unsettling,” wrote one user. Another added, “Following the SK Telecom case, these incidents keep happening. We can’t change all our information, and that’s frustrating.” One customer shared that they had changed their email password and updated their bank security settings in response to the news.
 

Dior Korea posted an apology to its website on May 13 following a data breach in January. [SCREEN CAPTURE]

 
In Korea last year, Dior and Tiffany & Company recorded 945.3 billion won ($689.4 million) and 377.9 billion won in revenue, respectively.
 
LVMH, which owns more than 80 brands, is now facing growing criticism regarding its groupwide data management capabilities. Consumers have begun to question whether other brands under the conglomerate are also affected, particularly as some worry that customer data may be stored or linked through shared data centers. However, other brands such as Bulgari responded that they could not confirm whether they had been affected.
 
“If customer databases were managed on a single server, it’s possible other brands could also be affected,” said Lim Jong-in, a professor at Korea University’s Graduate School of Information Security. “Each brand needs to quickly investigate and, if data was compromised, report the scale and inform customers.”

Translated from the JoongAng Ilbo using generative AI and edited by Korea JoongAng Daily staff.
BY HWANG SOO-YEON [[email protected]]

_{Images are for reference only.Images and contents gathered automatic from google or 3rd party sources.All rights on the images and contents are with their legal original owners.}