Sephora sephora.com.au Sephora data breach: what happened and what to do
In about January 2017 the beauty retailer Sephora suffered a data breach affecting customers in South East Asia, Australia and New Zealand. Have I Been Pwned counts 780,073 accounts, with email addresses, names, genders, dates of birth, ethnicities and other personal details.
View all 13,115 breaches- Breach date
- 9 Jan 2017
- Affected
- 780,073
- Data exposed
- Dates of birth, Email addresses, Ethnicities, Genders, Names, Physical attributes
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Have I Been Pwned dates the Sephora breach to approximately January 2017 and added the data on 6 October 2019. It affected customers in South East Asia, Australia and New Zealand and counts 780,073 accounts, about 780,000 unique email addresses.
Sephora's notice in July 2019 covered online customers in Singapore, Malaysia, Indonesia, Thailand, the Philippines, Hong Kong, Australia and New Zealand, as reported by Dark Reading. It said North American customers weren't affected because its regional databases run independently, per SC Media.
What was exposed
Email addresses alongside names, genders, dates of birth, ethnicities and other personal information, per HIBP. Sephora said it found no evidence that credit card information was compromised. As a precaution it cancelled all existing customer account passwords and offered a free data monitoring service through a third-party provider.
What that lets criminals do
A name, date of birth and email address together are useful for identity fraud and for convincing phishing. Dates of birth don't change, so this data stays useful for years. Expect messages that mention Sephora, a loyalty account or beauty offers.
What to do
If you set a new password after Sephora's reset, make sure it's unique. Be alert for phishing, and consider extra checks on accounts that use your date of birth to verify you.
What to do if you were in it
- 1
Make sure your Sephora password is unique
Sephora cancelled customer passwords after the incident. If you reused the old one anywhere, change it on those sites too.
- 2
Expect phishing that mentions Sephora
Your email, name and date of birth were exposed. Be wary of loyalty, refund or offer messages, and open the retailer's site yourself.
- 3
Watch accounts that use your date of birth
A date of birth can't be changed. Turn on two-factor login on banking and email, and review statements for activity you don't recognize.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't delete breach data, but it tells you what to change.
Frequently asked
Was I affected by the Sephora data breach?
It covered customers in South East Asia, Australia and New Zealand. Enter your email on Have I Been Pwned to check, or run a free Serus scan.
What was exposed in the Sephora breach?
Email addresses, names, genders, dates of birth, ethnicities and other personal information, per Have I Been Pwned.
Were credit cards exposed?
Sephora said it found no evidence that credit card information was compromised.
Should I change my password?
Sephora cancelled existing customer passwords. Use a unique password on the new one, and change any other site where you used your old one.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
