Fashion retailer Love, Bonito says customer data potentially exposed in security incident

The fashion retailer says names, contact details and partial payment information may have been exposed.

SINGAPORE: Fashion retailer Love, Bonito said that some customers' personal data may have been exposed after a security vulnerability on its website allowed unauthorised access to account information.

In an email to customers on Thursday (Jul 30), CEO Dione Song said the company identified the vulnerability on Jul 26 and resolved it on the same day.

Based on its investigations, the data that may have been affected includes customers’ names, dates of birth, email addresses, shipping addresses, phone numbers and order history details.

Partial payment information - such as card type, the last four digits of card numbers and expiry dates - may also have been affected for customers who used cards on the website.

However, full credit card details were not exposed, the company said. "This information is processed and held directly by our payment processor - we do not have access to or store this information ourselves," Ms Song added.

Following the incident, Love, Bonito said it had secured the affected systems, notified the relevant data protection authority and reported the matter to law enforcement. It is continuing to review its security measures.

Apologising to customers, Ms Song said the company has since strengthened its internal safeguards to prevent a similar issue from recurring.

"We are continuing to audit and review our security measures, and will make further improvements as needed to prevent an incident of this nature from happening again," she said.

The retailer advised customers to remain vigilant against potential scams, warning that exposed personal details could be used to make phishing attempts appear more convincing.

Customers were urged to be cautious of unsolicited calls, emails or messages, and to never share one-time passwords or verification codes. They were also advised to monitor their payment card activity and report any unauthorised transactions promptly.

As an added precaution, the company suggested enabling two-factor authentication on payment cards and registering phone numbers with Singapore’s Do Not Call Registry to reduce unsolicited communications.

Love, Bonito said customers with queries can contact its support team via email.

Love, Bonito was fined S$24,000 (US$18,700) in 2022 after more than 5,000 customers' personal data was accessed and stolen through malicious code on its e-commerce website.

CNA has asked Love, Bonito about how many customers were affected by the latest incident.

The Personal Data Protection Commission said it is investigating the incident.