{"id":"rituals-my-rituals-member-data-breach-apr-2026","category":"breach","status":"closed","title":"Rituals breach: attackers download My Rituals members' names, contact details and birth dates","tldr":"Dutch cosmetics brand Rituals says attackers downloaded part of its My Rituals member database: names, contact details, birth dates and gender. Passwords and payment details were not accessed. Treat unexpected messages mentioning your account as suspect. No fix is needed.","summary":"Rituals, the Dutch cosmetics and home-fragrance brand, disclosed on 22 April 2026 that an unauthorised party had downloaded part of the data held for its My Rituals loyalty programme. The company says the data may include full name, email address, phone number, date of birth, gender and home address, to the extent a member shared them. Rituals says no passwords or payment information were accessed. It has not said how many people are affected; the programme has more than 41 million members. Rituals says it blocked the attackers' access, began a forensic investigation, told the relevant authorities and emailed affected customers, including some in the United States. It says it has found no evidence the data has been published. No criminal group has claimed the attack, and Rituals has not described how it happened. Searches up to early November 2026 found no later developments: no confirmed leak, attribution, final count or regulator finding. The risk is mainly phishing and scam messages that use real personal details.","action":"If you have a My Rituals account, treat unexpected emails, texts or calls that mention your account or personal details with suspicion, and go to the Rituals website directly rather than using links in messages. Nothing needs updating, and Rituals says passwords were not taken.","product":"Rituals My Rituals loyalty programme (customer database)","audience":"home","severity":"medium","patch":"na","exploited":false,"cves":[],"tags":["rituals","data-breach","loyalty-programme","retail","netherlands","phishing-risk","personal-data"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"news","title":"Cosmetics giant Rituals discloses data breach affecting customers","url":"https://www.bleepingcomputer.com/news/security/cosmetics-giant-rituals-discloses-data-breach-affecting-customers/","by":"BleepingComputer","date":"2026-04-23"},{"kind":"news","title":"Cosmetic brand Rituals latest company to report hack, client data stolen","url":"https://nltimes.nl/2026/04/22/cosmetic-brand-rituals-latest-company-report-hack-client-data-stolen","by":"NL Times","date":"2026-04-22"},{"kind":"news","title":"Luxury cosmetics giant Rituals discloses data breach impacting member personal details","url":"https://www.securityaffairs.com/191192/data-breach/rituals-discloses-a-data-breach-impacting-member-personal-details.html","by":"Security Affairs","date":"2026-04-23"}],"started":"2026-04-22","closed":"2026-04-23","created":"2026-11-03T21:34:12.220Z","updated":"2026-11-03T21:34:12.220Z","cve_notes":[],"timeline":[{"at":"2026-04-23","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"Security Affairs repeated that Rituals had found no sign the data was public and urged members to watch for phishing. Searches to early November 2026 found no later reporting of a leak, a claim by a criminal group, the number affected, or the outcome of the investigation.","url":"https://www.securityaffairs.com/191192/data-breach/rituals-discloses-a-data-breach-impacting-member-personal-details.html","by":"Security Affairs","patch":"na"},{"at":"2026-04-23","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"BleepingComputer reported the company's notice. Rituals said it had blocked the attackers' access, started a forensic investigation, told the relevant authorities and emailed affected customers. The programme has over 41 million members, but Rituals did not say how many were hit. No group had claimed responsibility.","url":"https://www.bleepingcomputer.com/news/security/cosmetics-giant-rituals-discloses-data-breach-affecting-customers/","by":"BleepingComputer","patch":"na"},{"at":"2026-04-22","added":"2026-11-03T21:32:34.430Z","kind":"disclosed","text":"Rituals told customers that an unauthorised party had downloaded part of its My Rituals members' data. It said passwords and payment details were not accessed, it believed the data had not been made public, and it would not say how many people were affected.","url":"https://nltimes.nl/2026/04/22/cosmetic-brand-rituals-latest-company-report-hack-client-data-stolen","by":"NL Times","patch":"na"}],"url":"https://hard.fyi/live/rituals-my-rituals-member-data-breach-apr-2026/","json":"https://hard.fyi/api/live?id=rituals-my-rituals-member-data-breach-apr-2026"}