Rituals confirms customer membership data breach

Netherlands-based cosmetics company Rituals has confirmed a data breach affecting customer personal information after hackers accessed and stole large amounts of data from its membership database.

The company disclosed the breach on Wednesday, according to an email sent to customers that has been viewed and verified.

Rituals said it identified an “unauthorised download” of members’ data in April, which included customers’ full names, dates of birth, genders, postal and email addresses, phone numbers, and preferred Rituals store and account type.

Rituals spokesperson Eline van Malssen said the hacker stole membership data belonging to customers across Europe and the United Kingdom.

It has also been confirmed that some customers notified by Rituals are based in the United States, and the spokesperson acknowledged that the incident also affects several U.S. customers.

The company did not provide details about the nature of the cyberattack and said its investigation is ongoing to determine how the breach occurred.

The cosmetics retailer is the latest in a growing list of companies affected by membership database breaches over the past year, following similar incidents at U.K. retail chains such as Co-op and Marks & Spencer. Customer membership data is often targeted by cybercriminals, who can use it for extortion by threatening to leak it publicly unless a ransom is paid.

When asked for further details, a Rituals spokesperson declined to comment on whether the company had received any communication from the attackers, did not provide a more specific timeline of the breach, and did not disclose the total number of affected customers, citing “security reasons.”

According to its official website, Rituals has more than 41 million customers in its membership database. The retail company reported €2.4 billion ($2.8 billion) in revenue in 2025.