Rituals, the Netherlands-based cosmetics brand, has confirmed a data breach affecting customers across Europe, the UK and beyond.
The company says hackers accessed and downloaded data from its membership database, exposing personal information linked to customer accounts.
What we know so far
Rituals identified what it described as an “unauthorised download” of customer data in April 2026. According to the company, the information taken may include:
- Full name
- Date of birth
- Gender
- Postal address
- Email address
- Phone number
- Preferred store location
- Account type.
This isn’t financial data, but it is still highly sensitive. Combined, these details can be valuable to scammers and fraudsters.
The breach affects customers in Europe and the United Kingdom, and some customers in the United States have also been notified.
Rituals has not confirmed how many customers were impacted. However, the company’s membership database reportedly includes more than 41 million users globally. That gives a sense of the potential scale, even if only a portion of those accounts were accessed.
Rituals has not explained how the attackers gained access or how long they may have been inside its system. The company says its investigation is ongoing.
That level of uncertainty is fairly typical in the early stages of a breach, but it also raises questions about how quickly the issue was identified and contained.
What Rituals customers should do now
Even without payment details, this type of personal data can still be misused. For example, it can be used to make phishing emails appear more convincing. When multiple pieces of personal information are combined, the risk increases.
If you have a Rituals account, there are some simple steps worth taking:
- Be cautious of unexpected emails or messages, even if they appear legitimate
- Avoid clicking links or downloading attachments from unknown sources
- Use strong, unique passwords for your accounts
- Consider enabling two-factor authentication where available
- Monitor your accounts for any unusual activity.
Even if you haven’t been contacted directly to confirm that your data was involved in this breach it’s sensible to stay alert.
In some cases, data breaches like this can lead to legal claims, particularly if there is evidence that security measures were not strong enough. If you’ve been contacted by Rituals, keep hold of any emails or notifications.
These can be useful if more information comes to light later.
Join the Claim connects consumers with SRA-regulated lawyers. Keep an eye out for updates on any potential claim and possible eligibility checks/registration opportunities.
