Rituals Discloses Data Breach Impacting Millions of Customers

Rituals confirmed a data breach affecting up to 41 million customer membership records.

Rituals, the Dutch cosmetics giant, has confirmed a data breach affecting its customer membership database of over 41 million customers. The compromised information includes full names, dates of birth, gender, postal and email addresses, phone numbers, preferred store, and account types.

• "We have determined that some of our members’ data was downloaded unlawfully," a Rituals spokesperson stated.
• After detection, Rituals "took measures and blocked access." The company also claims, "as far as we know, the data in question has not been made public."

While the full scope of the breach remains under review, the incident highlights the broader wave of cyberattacks hitting Dutch companies. Recent targets include Odido, ChipSoft, Booking.com, and Basic-Fit, with the Odido hack alone affecting 6.2 million people and prompting a class action lawsuit. (DutchNews)

This surge in attacks emphasizes the urgent need for robust data protection practices and diligent compliance to privacy frameworks such as the GDPR. For in-house legal and compliance professionals, the Rituals breach serves as a high-profile reminder to revisit incident response plans, regulatory notification timelines, and risk mitigation strategies.

Yes, but: Rituals states that, to its knowledge, the compromised data has not yet been made public.