Summary
- Environment: Luxury retail
- Operational impact: Customer data exposed across multiple LVMH brands
- Financial impact: No financial figure is established by the reviewed source evidence
- Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.
What happened
In 2025, Louis Vuitton experienced an incident in its luxury retail environment. The retained source describes the attack path as follows: Voice phishing induced personnel to authorize a malicious connected OAuth application in Salesforce. [2]
The documented consequence was: Customer data exposed across multiple LVMH brands. [2]
Impact
- Documented impact: Customer data exposed across multiple LVMH brands. [2]
- No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.
Threat Group & Attack Vector
The retained source describes the attack path as follows: Voice phishing induced personnel to authorize a malicious connected OAuth application in Salesforce. The canonical record does not add intrusion steps beyond those supported by the source. [2]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1566 — Phishing — mapped from the cited behavior. [2]
- T1528 — Steal Application Access Token — mapped from the cited behavior. [2]
Response
The reviewed source does not describe containment, notification, or restoration steps in enough detail to summarize them responsibly.
This account is bounded to Data breach notification involving Louis Vuitton and Beyond perimeter defense: Lessons from recent Salesforce instance compromises. Details absent from that evidence are left unresolved rather than inferred. [1][2]