Luxottica luxottica.com Luxottica data breach: what happened and what to do
Data taken from a Luxottica partner in March 2021 leaked in 2023. Have I Been Pwned lists 77,093,812 accounts with names, emails, phone numbers, addresses, dates of birth and genders. Luxottica said no financial data or SSNs were involved.
View all 13,115 breaches- Breach date
- 16 Mar 2021
- Affected
- 77,093,812
- Data exposed
- Dates of birth, Email addresses, Genders, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Luxottica owns eyewear brands such as Ray-Ban and Oakley and runs retail chains including LensCrafters and Sunglass Hut. If you have bought glasses or booked an eye exam at one of them, your details may be in a dataset that spread online in 2023. Have I Been Pwned (HIBP) added 77,093,812 accounts on 19 May 2023.
What happened
HIBP dates the data theft to 16 March 2021. Luxottica's own account, reported in the press, is that the incident came through one of its partners and that it learned about it from a post by a third party on the dark web in November 2022. The stolen database was then leaked on hacking forums between 30 April and 12 May 2023.
Researchers who studied the data counted about 305 million records but only about 74 million unique email addresses, which is why press figures such as 70 million differ from HIBP's 77 million. HIBP counts unique accounts. Troy Hunt, who runs HIBP, said roughly three quarters of the addresses were already in its database from other breaches.
What was exposed
HIBP lists six data types: dates of birth, email addresses, genders, names, phone numbers and physical addresses. Luxottica told reporters that no financial information, login credentials or Social Security numbers were leaked.
What that lets criminals do
This is a classic identity profile. Name, birth date, gender, address, phone and email together are enough to answer many of the checks a bank, carrier or credit issuer asks before it lets someone open an account or reset a login. Dates of birth cannot be changed, so the risk does not fade.
The eyewear connection helps scammers too. Messages that mention an eye exam, an order or insurance coverage for glasses are easy to write and easy to believe. Expect emails and texts that pose as LensCrafters, Pearle Vision or an insurer and ask you to confirm details.
Phone numbers invite SIM swap attempts, where a criminal convinces your carrier to move your number to a new SIM and then collects the login codes sent by text.
The company's response
Luxottica confirmed the 2021 incident after the leak became public and said its investigation was ongoing at the time. It has described the cause as a third-party partner, not its own core systems. For the latest notices, check Luxottica's own announcements.
An old leak with a long tail
The data was taken in 2021 but spread in 2023, and it is still in circulation. Some details, like your birth date, still apply. Others, like an old address or phone, may be out of date but still useful to a scammer who wants to sound informed.
What to do if you were in it
- 1
Expect phishing and smishing about eye exams and orders
Messages that mention an eyewear brand, an appointment or an insurance claim may be built from this data. Never use a link in a text or email. Open the brand's site yourself.
- 2
Freeze your credit at all three bureaus
Birth date, name and address are what identity thieves use. A freeze at Equifax, Experian and TransUnion is free and quick online. Lift it when you need to apply for credit.
- 3
Add a PIN to your mobile account
Ask your carrier to set an account PIN and a port-out lock so nobody can move your number to another SIM.
- 4
Watch statements and credit reports
Check your credit reports at AnnualCreditReport.com and scan card and bank statements for charges or accounts you do not recognise.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next one early. It can't remove data from breach dumps, which is why the other steps here matter.
Frequently asked
Was I affected by the Luxottica data breach?
HIBP lists 77,093,812 accounts. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the Luxottica breach?
Dates of birth, email addresses, genders, names, phone numbers and physical addresses. Luxottica said no financial data, credentials or SSNs leaked.
Why do news reports say 70 million and HIBP says 77 million?
HIBP counts unique accounts it loaded from the leak. Press outlets quoted earlier or different counts of customers, so the numbers differ.
Should I change my password?
Passwords were not listed as exposed, so the priority is your credit and phone account. Change any password you reused anyway.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
