MANILA, Philippines (Aug. 2026) — Cybercriminals are targeting online fashion stores, and a popular brand just gave shoppers a massive wakeup call after getting hit by its second major security flaw. Singapore-based fashion retailer Love, Bonito recently disclosed a data breach that exposed sensitive customer information, raising serious concerns about how online stores handle user identity and security.
The breach allowed hackers to gain unauthorized access to personal accounts. Exposed data includes first and last names, birth dates, email addresses, shipping addresses, phone numbers, order histories, and partial payment information. Fortunately, full credit card details remained safe because they are managed by an external payment processor.
A repeat offense for the fashion brand
This is not the first time the clothing brand has dealt with cyberattacks. Hackers previously compromised the retailer back in 2019, which led to a fine from Singapore’s Personal Data Protection Commission due to a weak password policy.
Experts point out that repeating a breach shifts the conversation from bad luck to poor vulnerability management. Takanori Nishiyama, the Senior Vice President for the Asia Pacific region at Keeper Security, explained that while fixing a flaw immediately is important, keeping up long-term digital hygiene is what actually protects users.
Why online shopping is a goldmine for hackers
E-commerce websites are prime targets because they store vast amounts of consumer data in one place. According to the Verizon 2026 Data Breach Investigations Report, external hackers were responsible for 99 percent of data breaches in the Asia Pacific region, with the exploitation of system vulnerabilities being the top entry point at 42 percent.
Nishiyama emphasized that protecting these platforms requires a shared effort. Online storefronts and digital merchants need to enforce strict security measures, such as phishing-resistant multi-factor authentication and limiting system access for administrative accounts. Regularly changing credentials and digital keys is also crucial.
While regular consumers are increasingly using secure login tools like passkeys, many backend servers and databases still rely on weak, shared passwords that never expire. Cybersecurity professionals recommend a zero-trust approach, where every single access request is verified, ensuring a compromised password results in a minor blip rather than a full-scale crisis.
