Love, Bonito customers’ personal information possibly exposed in data breach
Sign up now: Get ST's newsletters delivered to your inbox
Love, Bonito stressed that the full credit card details of customers were not exposed.
PHOTO: ST FILE
- Love, Bonito detected a security vulnerability on July 26, allowing unauthorised access to customer data including names, birthdates, contact and partial payment card details.
- The company fixed the issue the same day, informed affected customers and is cooperating with authorities while enhancing cybersecurity measures.
- Customers are urged to watch for phishing, protect verification codes, monitor card activity, and register with the Do Not Call Registry to reduce risks.
AI generated
SINGAPORE – The personal data of some customers of home-grown fashion label Love, Bonito may have been compromised in a recent data breach.
In an e-mail sent to affected customers on July 30 and seen by The Straits Times, the company said it identified a “security vulnerability” in its website on July 26 that allowed unauthorised access to some customers’ account information.
The e-mail did not state how many people were affected or what the vulnerability was.
The brand said: “Upon discovering this issue, we acted immediately to contain it. The vulnerability was resolved on the same day it was identified, and we have since strengthened our internal safeguards to prevent a similar issue from recurring.”
In its reply to queries from The Straits Times on July 31, the Personal Data Protection Commission (PDPC) said that it “is aware and investigating the incident”.
According to the e-mail, information that could have been exposed includes customers’ first and last names, birthdates, e-mail addresses, shipping addresses and phone numbers.
Payment information, such as the card’s last four digits and expiry date, may also have been affected if customers had used a card for an order on the Love, Bonito website.
In the e-mail, Love, Bonito stressed that the full credit card details of customers were not exposed.
It said: “This information is processed and held directly by our payment processor – we do not have access to or store this information ourselves.
“We are continuing to audit and review our security measures, and will make further improvements as needed to prevent an incident of this nature from happening again.”
Responding to The Straits Times’ queries, Love, Bonito chief executive Dione Song said the company is taking the breach very seriously.
She added that all affected customers in Singapore have been informed.
“We sincerely apologise to our customers and are committed to strengthening our systems and are taking additional steps to enhance our cybersecurity,” said Song.
The company has also notified the Singapore Police Force, the PDPC, and the respective regional authorities, and is cooperating fully with their investigations.
Song said: “As the incident is currently under investigation, we will not be able to share further details at this point.”
Meanwhile, Love, Bonito encouraged customers to be wary of phishing attempts and to stay alert to unexpected calls, e-mails or text messages referencing their names, addresses or order history.
One-time passwords or verification codes should not be shared with anyone, including individuals claiming to be from Love, Bonito or the customers’ bank.
Customers should also monitor their payment card activity and register with the Do Not Call Registry to reduce unsolicited telemarketing calls and messages.
In 2024, Love, Bonito was fined $24,000 over a 2019 data breach involving more than 5,500 customers.
ST has contacted the Cyber Security Agency of Singapore for more information.
