Exclusive: Fashion retailer Express left customers' personal data and order details exposed to the internet

Last day to exhibit your breakthrough to 10,000+ tech leaders at Disrupt is on Oct 2. Book Exhibit Table Now. Disrupt doors open Oct. 13. Get your pass and bring someone with you at 50% off. REGISTER NOW. Fashion giant Express has patched its website to fix a security flaw that allowed anyone to view other people’s order details and personal information, TechCrunch has exclusively learned. At least a dozen of Express’ customer orders had been publicly listed in web search engine results. The security flaw exposed order confirmation pages on Express’ online store, revealing details of purchases and who made them. The exposed information contained customer names, phone numbers, and email addresses; postal, billing, and delivery addresses; order details, including the items that a customer purchased; and partial payment card information, including the card type and the last four-digits. Express is a large clothing retailer with hundreds of stores across the United States, Mexico, and Latin America. The once-publicly listed company is now run by WHP Global, which also owns several fashion and retail giants. Rey Bango, a security and privacy advocate, accidentally discovered the flaw af

Apr 16, 2026 → Apr 16, 2026