Archive — US — techcrunch
Fashion retailer Express left customers’ personal data and order details exposedto the internet
Fashion retailer Express has fixed a website security flaw that exposed customers' order details and personal data online. The vulnerability allowed anyone to view sensitive information such as names, addresses, and partial payment card details. The flaw was discovered by Rey Bango while investigating a fraudulent purchase. Express has not confirmed plans to notify affected customers or establish a dedicated security reporting mechanism.
Key points
- Express fixed a security flaw on its website that exposed customer order details.
- The flaw revealed sensitive data including names, emails, addresses, and partial payment card info.
- It was identified by Rey Bango, who discovered the issue while researching a fraudulent transaction.
- Express was contacted by TechCrunch, after which they quickly patched the flaw.
- The company did not clarify whether it would inform affected customers or implement a vulnerability disclosure program.
Why it matters
- In 2025, data security and privacy are major concerns for consumers, affecting trust in digital platforms.
- The trend of increasing cyber vulnerabilities in retail has been evident as showcased by incidents at Home Depot and Petco.
- This incident highlights the ongoing challenges retailers face in securing customer data amidst rising digital transactions.
The Express security breach underscores the critical importance of robust data protection measures in retail, as customers increasingly rely on online shopping, necessitating companies to prioritize cyber resilience.