Zales.com Leaked Customer Data, Just Like Sister Firms Jared, Kay Jewelers Did in 2018
Summary: Zales.com, a Signet Jewelers subsidiary, updated its website this week to fix a customer data exposure nearly identical to one Signet remediated on its Kay Jewelers and Jared sites in December 2018. A reader browsing Zales.com found she could view another customer's order information - name, billing and shipping address, phone number, email, items and total purchased, delivery date, tracking link, and the last four digits of the card number - by altering a lengthy numeric string in the order link.
Key Takeaway: Signet said it found no misuse or negative impact, but the same flaw class sat unfixed on a sister site for nearly three years, and a Dallas developer described how the exposed order details support package theft and convincing card-replacement scams that quote the last four digits.
Read the original at Krebs on Security ↗
- Topics
- Privacy
- Related
- Italy Fines Meta €805 Million Over Facebook's Android Gallery Access Without Explicit Consent Cyber Risks · Nov 15, 2026