Rituals, the renowned cosmetics company based in the Netherlands, has recently confirmed a breach of its customer membership database, resulting in unauthorized access to personal information. The incident was disclosed to customers via email, as reported by TechCrunch.
In April, the company detected an unauthorized download of sensitive member data, which included full names, dates of birth, genders, email addresses, postal addresses, phone numbers, preferred store locations, and account types.
According to Eline van Malssen, a spokesperson for Rituals, the breach primarily affected customers in Europe and the United Kingdom. However, some affected individuals are also located in the United States, indicating a broader impact than initially anticipated.
While the specifics of the cyberattack remain under investigation, Rituals has not provided details on how the breach occurred or whether they have received any communication from the perpetrators. The spokesperson refrained from sharing a precise timeline of events or the total number of members affected, citing security concerns.
This incident places Rituals among a growing list of retailers that have experienced data breaches recently, including notable names like Co-op and Marks & Spencer. Such breaches highlight the increasing vulnerability of customer records, which are often targeted by hackers seeking to exploit sensitive information for ransom.
Rituals boasts a membership database of over 41 million customers and achieved significant revenue of €2.4 billion ($2.8 billion) in 2025. As the investigation progresses, the company aims to enhance its security measures to protect customer data more effectively in the future.
The ongoing evolution of cybersecurity threats underscores the importance of robust data protection strategies in the retail sector. As companies like Rituals navigate these challenges, the focus on safeguarding consumer information will likely shape industry standards and practices moving forward.