Giglio giglio.com Giglio data breach: what happened and what to do
In August 2025, over 1M email addresses appeared in a breach allegedly taken from Italian fashion retailer Giglio. HIBP counts 1,026,468 accounts. Exposed: email addresses, names, phone numbers and physical addresses. Giglio did not respond to HIBP.
View all 13,115 breaches- Breach date
- 9 Aug 2025
- Affected
- 1,026,468
- Data exposed
- Email addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Giglio is an Italian luxury fashion retailer and designer. In August 2025, more than 1 million email addresses appeared in a breach that was allegedly taken from the company. Have I Been Pwned (HIBP) dates it to 9 August 2025 and added it on 1 September 2025, counting 1,026,468 unique email addresses. HIBP marks the data as verified.
HIBP says Giglio did not respond to repeated attempts to disclose the incident, and the entry cites no outside article. No company notice, regulator filing or settlement is public, so the facts here come from HIBP's analysis of the data. How the data was taken is not public.
What was exposed
HIBP lists email addresses, names, phone numbers and physical addresses. No passwords or payment card numbers are listed.
For an online fashion shop, that combination is the delivery and contact profile of a customer: who you are, where you live, what number reaches you and which email to write to. It is the kind of record scammers want because every field can be used in a believable message.
What that lets criminals do
Phishing and smishing come first. A text that says "your Giglio order could not be delivered" and carries your real name and city is far more convincing than a generic one. A fake refund email or a payment link for a "failed" order is a common pattern with fashion retailers, where customers are used to delivery and returns messages.
A phone number and home address together also enable doorstep and phone scams, such as calls pretending to be a courier. If you have shopped with Giglio, treat unexpected parcels, calls and refund offers with suspicion.
Because Giglio is based in Italy, European customers have rights under the GDPR, including the right to ask what data a company holds about them. This is general information, not legal advice. The Italian data protection authority, the Garante, publishes guidance for filing a complaint.
Why contact details matter
A password can be reset. A phone number and a home address can't be, at least not easily. Once they sit next to your name in a leaked file, they can be used for years by anyone who buys or finds it. Scammers match them with other leaks to build a fuller profile, which makes a later call or text more convincing. That is why spotting the scam matters more than any single reset.
The company's response
Giglio did not respond to HIBP's repeated disclosure attempts and has made no public statement. There is no company-run credit monitoring or official guidance to link to, so the steps below are the practical ones.
What to do if you were in it
- 1
Expect delivery and refund scams
Texts and emails about a failed delivery, a refund or a payment problem may use your real name and address. Don't click the link. Open the retailer's site by typing the address yourself.
- 2
Be wary of phone calls
A caller who knows your address and phone number can sound legitimate. Hang up and call the company back on a number you found yourself.
- 3
Use a unique password on shopping accounts
HIBP lists no passwords here, but retail accounts are common targets. Change the Giglio password if you reused it, and add 2FA where available.
- 4
Know your GDPR rights
If you are in the EU, you can ask Giglio what data it holds on you. The Italian data protection authority, the Garante, explains how to complain.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It checks breach databases and the dark web for your email and phone number and tells you which leaks include them, so you know which passwords to change first.
Frequently asked
Was I affected by the Giglio breach?
Search your email on Have I Been Pwned. HIBP counts 1,026,468 unique email addresses in the data.
What was exposed in the Giglio breach?
Email addresses, names, phone numbers and physical addresses. HIBP lists no passwords or payment details.
Did Giglio confirm the breach?
HIBP says the company did not respond to repeated attempts to disclose it. Giglio has made no public statement.
Should I change my password?
No passwords are listed, but change it if you reused it on other sites. Watch for phishing first.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
