Incident · State breach notice (South Carolina Department of Consumer Affairs)
Louis Vuitton data breach: client database accessed on June 7, 2025, 172,000 people
Compiled from public records. Updated 2026-11-13. By the cisonews.net Desk.
The Louis Vuitton data breach affected 172,000 people in its North American business, according to the Oregon Department of Justice's breach list, which records a breach from June 7 to June 13, 2025 and notice on August 22, 2025. The company says an unauthorized party got into a database of client data on June 7, 2025, which it found on July 2. Names, contact details, addresses, dates of birth and passport numbers were involved, and in a few cases other government ID numbers. No payment card or bank account data was in that database. Louis Vuitton offers 24 months of Experian IdentityWorks. Indiana's 2025 report gives the same total, 172,000, with 4 Indiana residents among them.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.
What happened at Louis Vuitton?
Louis Vuitton became aware of a cybersecurity incident on July 2, 2025 and brought in outside cybersecurity experts. The investigation found that an unauthorized party had gained access to a client database on June 7, 2025. The company says the incident is contained and that it notified law enforcement.
| Date | What happened | Source |
|---|---|---|
| June 7, 2025 | Unauthorized access to the client database | Louis Vuitton letter; Oregon list |
| June 13, 2025 | End of the breach window | Oregon list |
| July 2, 2025 | Louis Vuitton becomes aware | Louis Vuitton letter; Oregon list |
| July 2025 | Louis Vuitton notifies clients in South Korea, Turkey, the UK, Italy and Sweden | BleepingComputer |
| August 22, 2025 | US notice; filed in South Carolina and Vermont; reported to Oregon and Indiana (172,000) | Letters; Oregon list; Indiana report |
| November 30, 2025 | Experian enrollment deadline | Louis Vuitton letter |
The access went unnoticed for 25 days, and letters followed 51 days after that. The notice-delay guide compares that with other notices.
Was the US breach part of a wider Louis Vuitton cyberattack?
Louis Vuitton notified clients in several countries in July 2025, and told BleepingComputer the notices came from one incident. BleepingComputer reported on July 16, 2025 that the company confirmed the breaches affecting customers in the UK, South Korea and Turkey stem from the same security incident; notices also went to customers in Italy and Sweden. When asked whether the regional notices were linked, the company said its statement applied to all notifications sent to clients.
The US letter, mailed on August 22, gives the same date of discovery as those notices, July 2, 2025. It does not itself say the US database was part of the same incident, and the company has not published a total across countries.
BleepingComputer also reported, citing unnamed sources, that the breaches at LVMH brands were linked to the ShinyHunters extortion group, which took data from a third-party vendor's database; an LVMH spokesperson said there was no additional information to share. The US letter names no attacker and no vendor.
| Where clients were told | When | What the record says |
|---|---|---|
| South Korea, Turkey, United Kingdom | July 2025 | Same incident, per the company to BleepingComputer |
| Italy, Sweden | July 2025 | Notices sent, per BleepingComputer |
| United States (Louis Vuitton North America) | August 22, 2025 | 172,000 people, per the Oregon list and the Indiana report |
What information was exposed in the Louis Vuitton breach?
It varies by client. The letter lists name, contact information, address, date of birth, and passport number or, in a small number of cases, another government ID number. The database did not hold payment card or bank account information.
What should Louis Vuitton clients watch for?
The letter warns clients to stay alert to suspicious or unsolicited emails, phone calls and text messages, and not to click suspicious links.
What is Louis Vuitton offering?
A 24-month Experian IdentityWorks membership with credit monitoring, fraud resolution and identity theft insurance, at no cost. Enrollment was at experianidworks.com/3bcredit by November 30, 2025, which has passed. Questions go to 1-866-566-3598, Monday to Friday, 8 a.m. to 8 p.m. Central Time. The guide to credit monitoring offers explains what a free credit freeze adds.
How many Washingtonians were affected by the Louis Vuitton breach?
Washington's attorney general lists a notice from Louis Vuitton North America, Inc. reported on August 22, 2025, with 17,615 Washingtonians affected. Its record names names, driver's license or state ID numbers, full dates of birth and passport numbers as the information compromised. The figure counts Washington residents only.
What the record leaves open
- How the unauthorized party got into the database.
- How many clients were affected outside North America; the July notices in other countries gave no public totals in the record.
- Whether the US client database is the same third-party vendor database BleepingComputer's sources described.
- Why Oregon's window runs to June 13 when the letter names only June 7.
How this disclosure's timing compares
Louis Vuitton North America, Inc. disclosed 51 days after the discovery date its notice gives. Across the 206 other state breach notices on cisonews.net that date discovery to the day, the median gap is 100 days.
Other consumer & retail incidents on cisonews.net
- PCH Digital, LLC (Publishers Clearing House), Breach notice, first disclosed November 11, 2026
- Victoria's Secret & Co., Breach notice, first disclosed November 9, 2026
- Mavis Tire Supply LLC, Breach notice, first disclosed November 3, 2026
- Revolve Group, Breach notice, first disclosed October 29, 2026; 1,515,073 affected in total (Indiana Attorney General)
- Del Monte Foods, Breach notice, first disclosed October 29, 2026; affected: 11 Rhode Island residents
Sources
- 2026-11-13 · AWashington State Office of the Attorney General, data breach notifications list, published November 13, 2026
- 2025-08-22 · ALouis Vuitton North America, Inc., consumer notice filed with the South Carolina Department of Consumer Affairs, published August 22, 2025
- 2026-11-11 · AOregon Department of Justice, consumer data breach list, published November 11, 2026
- 2025-08-22 · ALouis Vuitton North America, Inc., notice to consumers filed with the Vermont Attorney General, published August 22, 2025
- 2026-11-12 · AIndiana Attorney General, 2025 data breach year-to-date report, published November 12, 2026
- 2025-07-16 · BBleepingComputer, Louis Vuitton says regional data breaches tied to same cyberattack, published July 16, 2025
Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.