The Kering case is far from unique. The intrusion occurred in June 2025, when the hacker group Shiny Hunters accessed names, email addresses, phone numbers, home addresses, and even records of how much customers had spent in stores. The case has resurfaced after the group recently began spreading parts of the material online. It highlights a broader trend where data theft is becoming an increasingly common method. Ransomware – in which systems are encrypted and ransom is demanded – remains one of the most prevalent global threats. But in parallel, we are seeing attackers focus more and more on stealing and selling consumer data, which today is just as valuable. When large customer databases become a commodity on the dark web, both companies and individuals suffer the consequences.
How the attacks typically unfold
Most intrusions don’t begin with advanced code, but with people. An employee is tricked into clicking a link in an email or handing over login details. Through a combination of phishing and social engineering, attackers gain access to company systems, often via SSO portals or cloud services.
Once inside, they can remain undetected for weeks or months, mapping the environment and quietly exfiltrating vast amounts of data before anyone notices. This attack pattern is on the rise – where the goal is not always to lock systems, but to siphon off customer databases that can later be sold.
Risks for consumers
For consumers, this development brings several risks:
- Identity theft: Attackers can use personal data to open accounts or take out loans in someone else’s name.
- Targeted fraud: When attackers know what you have purchased or where you live, scam emails and SMS messages become far more convincing.
- Long-term consequences: Data that has leaked once can be reused in new attacks years down the line.
This means the consequences of a data breach can be both immediate and prolonged – long after the company itself has closed the incident.
Why companies must act proactively
For many organizations, the focus still lies on incident plans and the ability to quickly restore operations after a breach. That is important – but not enough when attackers are systematically targeting customer data. By the time the intrusion is discovered, enormous amounts of information have often already been extracted.
That is why security today must be treated as a fundamental business principle, not as an afterthought. It must be embedded in everything from system architecture and access controls to employee training and board-level reporting. In short: preventive measures make the difference between a blocked attack and millions of leaked customer records.
“A single successful phishing email can become a catastrophe. Invest in MFA, segmentation, and real-life exercises – otherwise, it’s the customers who risk paying the price.”
– Pernilla Rönn, Head of Cybersecurity, HiQ
Seven priority actions to reduce risk
- Reduce the success rate of phishing. Carry out regular phishing simulations for all employees. Pay special attention to administrators and other roles with sensitive access.
- Implement Multi-Factor Authentication (MFA). Ensure MFA is enforced across all user accounts and environments. App-based MFA or hardware tokens are more secure than SMS.
- Zero trust & segmentation. Apply the principle of least privilege. No user or service should have more access than absolutely necessary.
- Detection and rapid isolation. Build the capability to monitor and secure endpoints and logs with EDR and SIEM solutions that can detect anomalies in real time. Regularly rehearse incident response.
- Protect data at the storage level. Encrypt customer data both at rest and in transit. Separate sensitive fields so entire databases cannot be exploited even if they leak.
- Manage third-party risks. Map suppliers and partners with access to customer data. Restrict external accounts and set security requirements in contracts.
- Elevate the issue to the board and leadership. Report on cybersecurity regularly at the highest level. New regulations like NIS2 make this a business responsibility, not just an IT issue.
Security as a competitive advantage
As the attackers’ logic evolves, so must that of companies. Minimizing costs after an incident is no longer enough – trust is at stake.
“Security is not a cost item, it’s the insurance for customer relationships. The companies that treat security as a strategic investment will be the ones still standing when others fall behind.”
– Pernilla Rönn, Head of Cybersecurity, HiQ
Conclusion
Customer data has become one of the most sought-after assets online. The intrusion against Kering is one of many examples of how quickly it can happen – and how severe the consequences can be.
Companies that embed security into their systems, processes, and culture not only reduce the risk of breaches. They also strengthen their competitiveness, their brand, and their customer relationships. In a time when hackers dig for customer data as if it were gold, only the companies that take security seriously will stand strong when the next attack comes.
Do you want to turn cybersecurity into a competitive advantage? Get in touch!
