UNOde50 Spanish Jewelry Brand Breach (2025): ~1.6M Customer Contact Records Exposed via WorldLeaks

About UNOde50

UNOde50 is a Spanish jewelry and accessories brand founded in the late 1990s, known for handcrafted, limited-run designs sold through its own boutiques and e-commerce channels internationally. It maintains customer accounts, contact details, order and shipping histories, and loyalty/marketing profiles across retail and direct-to-consumer operations.

Why They Hold Your Data

Jewelry and accessories brands collect customer identity, contact details, addresses, order history, loyalty records, and payment-adjacent data across direct-to-consumer and retail operations.

Recent Developments

The WorldLeaks extortion group listed UNOde50 as a victim on November 14, 2025. As of the latest reporting, details of the exposed data were limited, UNOde50 had not issued a detailed public confirmation, and there was no independent verification of the specific data types or volume.

Data Points Exposed

Breach Impact

For a consumer jewelry brand, the confirmed exposure of customer contact data (emails and phone numbers) primarily enables phishing, smishing, order- and delivery-impersonation scams, and profiling of purchase behavior. Because the brand is luxury-adjacent, exposed customers may be targeted as higher-value households. The breach also carries reputational and GDPR regulatory exposure given the company’s Spanish/EU base.

Exploitation & Downstream Threats

• Targeted phishing and smishing using exposed emails and phone numbers | • Order, delivery, and refund-impersonation scams referencing the brand | • Credential stuffing/account takeover against reused customer passwords | • Profiling/targeting of higher-value households based on luxury purchase behavior

What You Should Do

1. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
2. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).