Luxury Giants Louis Vuitton, Dior, Tiffany Fined $25M for Data Breaches
▼ Summary
– South Korea’s data protection agency fined Louis Vuitton, Dior, and Tiffany a total of $25 million for security failures that led to breaches exposing over 5.5 million customers’ personal data.
– The breaches occurred when hackers, linked to the ShinyHunters gang, accessed the brands’ cloud-based customer management systems via methods like malware and phishing attacks on employees.
– Investigators found specific security lapses, including a failure to implement IP-based access controls, secure authentication, and restrictions on bulk data downloads.
– The companies also violated reporting rules, with Dior notably notifying authorities five days after discovery instead of the required 72 hours.
– The regulator emphasized that using SaaS solutions does not transfer a company’s legal responsibility for securing customer data to the vendor.
South Korea’s data protection authority has levied substantial fines totaling $25 million against three major luxury brands, Louis Vuitton, Christian Dior, and Tiffany, for severe security lapses that compromised the personal information of over 5.5 million customers. These high-profile companies, all under the LVMH corporate umbrella, experienced significant data breaches when cybercriminals infiltrated their shared cloud-based customer management platforms. The incidents underscore a critical failure to implement fundamental cybersecurity measures, despite the sensitive nature of the data involved.
The regulatory body, the Personal Information Protection Commission (PIPC), detailed how each breach unfolded. For Louis Vuitton, the compromise began when an employee’s device became infected with malware. This infection provided a gateway for attackers to access the brand’s software-as-a-service (SaaS) system, leading to the exposure of records for approximately 3.6 million individuals. Investigators have linked the activity to the notorious ShinyHunters hacking group, known for targeting platforms like Salesforce. The PIPC found that Louis Vuitton had used the SaaS tool since 2013 but critically failed to restrict access by IP address or enforce secure authentication methods for remote logins. As a result, the company faces a penalty of $16.4 million and must publicly announce the fine on its official website.
At Christian Dior, the attack vector was a phishing email directed at a customer service representative. The employee was deceived into providing credentials that granted hackers entry to the system, compromising data for nearly two million customers. The investigation revealed that Dior, which had adopted the platform in 2020, did not employ essential security protocols. The company neglected to use IP allow-listing, impose limits on bulk data downloads, and regularly review access logs. This lack of oversight meant the breach went undetected for more than three months. Furthermore, Dior South Korea reported the incident to regulators five days after discovery, missing the mandatory 72-hour notification window under South Korean law. These cumulative failures resulted in a $9.4 million fine.
The breach at Tiffany followed a similar pattern, with attackers using voice phishing to manipulate an employee into providing system access. While the scale was smaller, affecting about 4,600 clients, the security shortcomings were identical. Tiffany also did not implement IP-based access controls or restrict mass data exports and delayed notifying affected customers beyond the legal deadline. The brand received a financial penalty of $1.85 million for these violations.
In its ruling, the PIPC delivered a clear message to corporations worldwide: adopting a SaaS solution does not absolve a company of its legal duty to protect customer data. The responsibility for securing personal information remains firmly with the business that collects it, not with the external vendor providing the software platform. This landmark enforcement action highlights the escalating global expectations for data security, even within industries traditionally focused on exclusivity and brand prestige. The fines reflect the serious consequences of neglecting basic cybersecurity hygiene, regardless of a company’s market position or the third-party tools it employs.
(Source: Bleeping Computer)
