Cosmetics giant Rituals confirms data breach of customer membership records

Rituals, the renowned cosmetics brand headquartered in the Netherlands, has acknowledged a significant data breach impacting the personal information of its customers. The company revealed this incident via an email to its members on Wednesday, as confirmed by TechCrunch, which has reviewed the communication. The breach, identified in April, involved an unauthorized download of sensitive member data, including full names, birthdates, genders, postal and email addresses, phone numbers, preferred store selections, and account types. Eline van Malssen, a spokesperson for Rituals, indicated that the attack primarily affected customers in Europe and the United Kingdom, although it has since come to light that some affected individuals reside in the United States. While the specifics of the cyberattack remain unclear, Rituals is actively investigating the incident to determine its origins and impact. This breach highlights a troubling trend, as Rituals joins the ranks of other retailers, such as Co-op and Marks & Spencer, that have experienced similar data security incidents over the past year. Customer records are particularly valuable to cybercriminals, who often leverage stolen data to extort companies by threatening to expose the information online. When asked for further details regarding the breach or any communications with the hackers, Rituals declined to provide specifics, citing security concerns. The company also refrained from disclosing the exact number of affected members. With over 41 million customers registered in its membership database and generating €2.4 billion ($2.8 billion) in revenue in 2025, the implications of this breach could be substantial for the cosmetics giant and its clientele.