Hong Kong Probes Louis Vuitton Data Breach Involving 419,000 Customers
Hong Kong’s privacy authority has launched a formal investigation into a major data leak at luxury fashion brand Louis Vuitton, which exposed the personal information of approximately 419,000 customers.
The Office of the Privacy Commissioner for Personal Data (PCPD) confirmed in a statement that the breach involved sensitive information such as:
- Names
- Passport details
- Residential addresses
- Email addresses
- Phone numbers
- Shopping history
- Product preferences
Louis Vuitton’s parent company, LVMH (LVMH.PA), reported the incident to the PCPD on July 17. The company had initially detected suspicious activity in its French headquarters on June 13, later discovering on July 2 that Hong Kong customer data had been compromised.
Investigation Into Delay and Compliance
The PCPD said it would investigate whether Louis Vuitton Hong Kong delayed notification of the breach in violation of local data protection laws. So far, no formal complaints or customer inquiries have been filed with the office.
A spokesperson for the PCPD stated: “We are actively examining the incident to assess compliance with Hong Kong’s Personal Data (Privacy) Ordinance, particularly regarding timely breach notification.”
Related Breach in South Korea
This incident follows a June 2025 cyberattack on Louis Vuitton’s South Korean operations, which also led to the exposure of customer contact information. However, in both cases, no financial data or payment details were compromised, according to the company.
Growing Concern Over Cybersecurity in the Luxury Sector
With the luxury retail sector increasingly reliant on digital systems for customer engagement and personalised shopping experiences, cybersecurity vulnerabilities pose growing risks. Experts say that cyberattacks targeting high-end brands can yield valuable consumer data that is often sold on the dark web.
Conclusion
As Louis Vuitton faces scrutiny from Hong Kong’s privacy watchdog, the incident underscores the importance of robust cybersecurity and rapid breach disclosure, especially for global brands handling high volumes of personal data.
