Cartier Confirms Customer Data Stolen in Cyberattack

Cartier has told customers that some of their data was stolen in a cyberattack. The luxury jeweler, part of the Richemont group, disclosed the incident in a message to affected clients, according to a Reuters report.

The company said attackers took a subset of customer information. Cartier did not state the total number of affected individuals in the notification reported by Reuters. The breach disclosure puts the jeweler on a growing list of luxury retailers handling intrusion notifications this year.

What did Cartier tell customers?

The company contacted clients directly to inform them that some of their data had been compromised. Reuters reported the notification without specifying the exact date of the intrusion or the date of detection. Cartier also did not publicly identify the attacker or group behind the incident.

At this stage, the following details remain undisclosed:

• The number of customers affected
• The categories of data taken, beyond the general statement that customer data was involved
• Whether financial information such as payment card details was accessed
• The date the intrusion occurred and when it was discovered
• The vector used to enter Cartier's systems

Cartier urged customers to remain alert to suspicious communications that could exploit the stolen information, a standard precaution after data theft involving contact details.

Why does this matter for security teams?

The incident illustrates the continuing exposure of high-end retail brands to targeted attacks. Luxury houses hold rich customer profiles, and attackers can use stolen data for phishing, fraud and impersonation schemes against wealthy clientele.

For CISOs at consumer-facing enterprises, the breach reinforces several operating realities:

• Customer notification obligations apply even when full forensic detail is not yet available
• Brand-sensitive organizations often disclose incidents before regulators publish findings
• Stolen contact data fuels downstream fraud regardless of whether payment data was taken

Cartier's parent, Richemont, owns brands including Cartier, Van Cleef & Arpels and Montblanc. The group has not issued a separate public statement beyond the customer communication reported by Reuters.

What happens next?

Cartier has not said whether it has engaged external forensic firms or notified data protection authorities. Regulators in markets where affected customers reside may require formal breach reports under laws such as the EU General Data Protection Regulation (GDPR, the European Union's data privacy statute).

Under GDPR, organizations must report qualifying breaches to supervisory authorities within 72 hours of becoming aware of them, where feasible. Whether Cartier has met that threshold with this incident is not yet public.

Customers who received the notification should treat unexpected messages referencing their Cartier relationship with caution. Attackers who possess verified customer data can craft convincing solicitation attempts.

CIO Monitor will update this story as additional details emerge on the scope of the breach, the data categories involved and any regulatory filings.

By Rebecca Stone