Fashion retailer Express left personal and order information accessible on the internet due to a software bug. TechCrunch discovered the exposure and notified the company, which has since patched the vulnerability.
Express customers' sensitive data was publicly visible online, including personal information and order details. The exposure resulted from a bug in the company's systems that made customer records accessible without proper security controls.
TechCrunch researchers identified the issue and contacted Express about the vulnerability. The retailer confirmed the problem and deployed a fix, resolving the exposure.
However, Express has not committed to notifying affected customers about the incident. The company declined to specify whether it would inform users that their data was exposed or provide details about the scope of the breach.
The incident raises questions about Express's security practices and customer communication protocols. For customers, the lack of transparency creates uncertainty about whether their information was accessed by unauthorized parties during the exposure period.
This breach adds to a growing list of retail data exposures affecting major companies. Retailers increasingly handle vast amounts of customer information—from payment details to addresses and purchase history—making robust security infrastructure essential.
Express has not released additional details about how long the data was exposed, how many customers were affected, or what specific information was compromised. These details typically matter for affected users determining their risk of identity theft or fraud.
Customers concerned about their information may want to monitor their accounts and consider placing fraud alerts with credit bureaus. Express has not provided specific guidance for customers or offered protection services related to the exposure.
A new macOS malware called CrashStealer disguises itself as Apple's crash-reporting tool to steal credentials, keychain data, and cryptocurrency wallets from infected systems.
Security firm Jscrambler disclosed that attackers published a malicious version of its npm package, which was downloaded nearly 1,500 times before detection. The compromised package contained infostealer malware targeting developer systems.
Security researchers are turning prompt injection attacks into a defensive weapon. The technique, called "context bombing," forces malicious AI agents to shut down before causing damage.
The Los Angeles Police Department has allowed its contract with surveillance company Flock to expire, citing serious civil liberties and privacy concerns. The move marks a significant departure for one of Flock's largest government customers.