has revealed a security breach in the Tommy Hilfiger Japan client database, exposing personal details of hundreds of thousands of customers. Tommy Hilfiger’s Japanese website, which received nearly one million visits so far in 2019, runs on an open Elasticsearch server not intended for URL access. But with minimal manipulation, the research team of Safety Detective was able to find the gaping security oversight to the customer database. The unsecured database provided easy access to the personal details of hundreds of thousand of customers in Japan, including first and last names, addresses, phone numbers, email addresses, dates of birth, last purchase dates, total orders made, and membership numbers. The unencrypted info, stretching as far back as 2014, was accessible without a password, leaving the sensitive data completely unprotected. In addition to the vast customer info, details on millions of orders were also accessible, including product descriptions, prices, pictures, sizes, SKUs, and manufacturing dates; as well as nation wide store locators complete with phone numbers, addresses, and more.Safety Detective team spoke to the Senior Vice President of Security at PVH, the parent company of Tommy Hilfiger (as well as Calvin Klein, Van Heusen, IZOD, ARROW, Speedo, Warner’s, and Olga), who acted quickly after receiving the disclosure to shut down the affected servers.
An unsecured database has exposed the personal data of millions of Tommy Hilfiger's Japanese customers. Security researchers from Safety Detective discovered that the company's Elasticsearch server could be accessed without a password, revealing the names, dates of birth, addresses, phone numbers, email addresses, and total orders of customers since 2014. Furthermore, the unsecured database included details, such as price and size, of hundreds of thousands of customer orders. Tommy Hilfiger's parent company PVH has since closed the affected servers. The website has had nearly one million visitors so far in 2019.