Data breach at Tiffany’s exposes gift card numbers

The American luxury jewelry behemoth, Tiffany & Co., has suffered a data breach that exposed thousands of clients, revealing their identities and gift card numbers.

According to the data breach notice the company sent to impacted individuals earlier this week, attackers penetrated Tiffany's systems in early May 2025. Once the unauthorized access was uncovered, the jewelry giant launched an investigation led by an external cybersecurity firm.

Information that Tiffany’s submitted to the Maine Attorney General’s Office revealed that over 2,500 people had their details exposed. Meanwhile, the data breach notice reveals that most of the exposed details relate to Tiffany’s gift cards. The exposed details include:

• Names
• Addresses
• Email addresses
• Phone numbers
• Sales data
• Client reference numbers
• Tiffany’s gift card number and PIN

Needless to say, revealing clients’ gift card purchases can result in attackers using the stolen details to purchase jewelry. Gift cards are a treasured mode of value transfer among cybercriminals as it allows to obtain goods and services with little traceability.

Other risks that impacted Tiffany’s clients face include phishing, where cybercrooks impersonate the company to trick clients into revealing additional personal data or even financial information.

“We take the security of your personal information seriously and are alerting you about this issue so you can take steps to help protect your information. To date, we have no evidence of harm or further misuse of the affected data in connection with the incident,” Tiffany’s data breach notice said.

This isn’t the first time that Tiffany’s has had to deal with its customer data being exposed. In late May, the luxury brand’s South Korean arm confirmed a vendor breach that exposed customer data.

Interestingly, Tiffany’s was the second brand from the luxury goods conglomerate Louis Vuitton Moët Hennessy (LVMH) that was affected in South Korea, with Dior informing its customers of a data breach first.

Attackers are always on the prowl for luxury goods makers. Earlier this week, Kering, the parent of luxury fashion brands Gucci, Balenciaga, McQueen, and others, confirmed it was the victim of a massive breach, exposing 7.4 million files of stolen customer data.

Headquartered on Fifth Avenue in Manhattan, Tiffany’s was acquired by the French conglomerate LVMH back in 2021 for nearly $16 billion. While the jeweler was still listed on the New York Stock Exchange, the company reported revenue exceeding $4 billion.

Unlock more exclusive Cybernews content on YouTube.