Aditya Birla Fashion and Retail Ltd, the Indian fashion retailer that operates Pantaloons and a portfolio of premium apparel brands, was breached in December 2021 by the data-extortion group ShinyHunters. The attackers gained unauthorized access to the company's e-commerce database, exfiltrated roughly 700 GB of data, and demanded a ransom. ABFRL declined to pay, and the data was subsequently published on a hacking forum in January 2022.\n\nThe leaked corpus contained around 4.5 million customer records, with around 5.4 million unique email addresses across associated brand sites. Customer fields included names, salutations, phone numbers, physical addresses, gender, marital status, religion, income levels, job titles, purchase histories, and passwords stored as weak MD5 hashes. The dump also included employee records covering salary, marital status, and religion, alongside invoices, server logs, and portions of website source code. The threat actor claimed full payment-card data with CVV was also among the files, an assertion the company publicly disputed.\n\nFor affected customers, the practical risk extends beyond standard contact-fraud scenarios because of the unusual sensitivity of fields exposed. Religion and income data create profiling and discrimination risks specific to the Indian context. The MD5-hashed passwords are effectively crackable by modern standards, raising credential-stuffing risk wherever the same password was reused. Anyone who held a Pantaloons, Jaypore, or other ABFRL-brand account in 2021 should rotate passwords across services and treat unsolicited messages referencing past purchases or loyalty programs with caution.

Multi-brand fashion retailers collect customer identity, contact details, addresses, order history, payment-adjacent data, and loyalty or marketing-engagement records across retail operations.

ABFRL has continued to operate and expand its retail and brand portfolio in the years since the 2021 breach. The company reset customer passwords and added one-time-passcode authentication after the incident. India's data-protection regime has matured significantly since 2021, with the Digital Personal Data Protection Act passed in 2023, which raises the regulatory expectations for any future incident at ABFRL or its peers. The company has not been publicly tied to a further large-scale breach disclosure since 2021. Public scrutiny of consumer-data practices in the Indian retail and e-commerce sector has increased steadily since the original incident.