Kering Luxury Fashion Group Breach (Salesforce, 2025): 56 Million Customer Contact Records Exposed

About Kering

Kering is a French multinational luxury goods holding company that owns and manages a portfolio of high-end fashion and lifestyle brands including Gucci, Saint Laurent, Bottega Veneta, Balenciaga, Alexander McQueen, Brioni, and others. Headquartered in Paris, the company is publicly listed on Euronext Paris and operates across more than 100 countries through owned retail boutiques, wholesale accounts, and e-commerce platforms. Kering is one of the two dominant players in the global luxury goods conglomerate market alongside LVMH.

Why They Hold Your Data

Luxury brand groups collect customer, employee, vendor, clienteling, and commerce records across multiple fashion and luxury houses, including contact, purchase, and operational data.

Recent Developments

Kering has faced a challenging period for luxury goods demand, particularly at Gucci, its largest revenue contributor, which saw significant sales declines beginning in 2024. The company has brought in new creative leadership at Gucci and undertaken strategic repositioning efforts across the brand. Kering divested several assets and has been focused on margin and portfolio management amid softer global luxury demand.

Data Points Exposed

Breach Impact

Kering was among the approximately 39 organizations listed on the Scattered LAPSUS$ Hunters dark web leak site in October 2025, with customer contact data including email addresses, phone numbers, and home addresses published as part of the Salesforce campaign. Security researchers noted that the Kering dataset represented a particularly high-value target because Gucci and other Kering brand customers include high-net-worth individuals — making the combination of names, contact information, and luxury purchase context useful for social engineering and fraud targeting wealthy consumers. Kering has not made detailed public statements about the specific scope of its exposure in this campaign.

Exploitation & Downstream Threats

• SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
3. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).