Blooms Today, a U.S. online flower and gift delivery service, suffered a data breach affecting 3.2 million customers. In April 2024, approximately 15 million records from the company appeared for sale on a hacking forum. The most recent data in that set dated to November 2023. The method of the breach has not been publicly disclosed. The exposed data included customer names, email addresses, phone numbers, physical addresses, and partial credit card details. The card data consisted of card type, the last four digits of the card number, and the expiration date. While this is not enough to make fraudulent purchases, the combination of personal and address data creates real risk. Attackers can use it to craft convincing phishing emails, impersonate delivery services, or target customers based on gifting patterns. Because Blooms Today handles occasion-based gifts, the data may also reveal personal relationships, including family members and romantic partners. Blooms Today did not respond to press inquiries about the incident. No class-action lawsuits or regulatory actions tied to this breach have been publicly documented. Affected individuals should be alert to phishing attempts that reference past orders or deliveries, and should treat any unsolicited contact claiming to be from a florist or courier service with caution.

Flower-delivery platforms collect customer identity, addresses, gift-order history, recipient details, payment-adjacent records, and delivery information across e-commerce fulfillment operations.

Blooms Today continues to operate as an online floral and gift retailer. No major organizational changes have been publicly reported in the period surrounding the breach.