ManoMano data breach impacts 38 million customers

The ManoMano data breach has impacted approximately 38 million customers after attackers gained access through a compromised third-party service provider. The European DIY marketplace confirmed that unauthorized actors accessed customer information linked to its external customer support partner. The incident triggered notifications across multiple countries and raised fresh concerns about third-party security risks.

ManoMano operates across several European markets and serves millions of users. Because of its scale, any exposure of customer data carries significant privacy and reputational implications.

How the Breach Happened

ManoMano identified suspicious activity involving a subcontractor that handled customer service operations. Attackers reportedly used credentials associated with that provider to access systems containing customer information. Once inside, they extracted data connected to millions of user accounts.

The company acted after detecting unusual access patterns and launched an internal investigation. Security teams worked to contain the intrusion and prevent further unauthorized access. The incident appears to have originated from the vendor environment rather than ManoMano’s core platform infrastructure.

This scenario reflects a common attack path. Threat actors often target external partners because they may maintain privileged access while operating under different security controls.

What Data Was Exposed

The ManoMano data breach exposed personal information tied to customer accounts and support interactions. The affected data may include:

• Full names
• Email addresses
• Phone numbers
• Customer service communication records

The company stated that attackers did not access passwords or payment information. However, even basic contact details can create risk. Criminals often use exposed data to launch phishing campaigns or impersonate trusted brands.

Because the breach involved support records, attackers may possess contextual details that make social engineering attempts more convincing.

Company Response

After confirming the breach, ManoMano revoked the compromised vendor access and strengthened its security controls. The company implemented additional monitoring and reviewed third-party permissions to reduce further exposure.

ManoMano began notifying affected customers and advised them to remain alert for suspicious communications. The company emphasized that it continues to work with cybersecurity specialists to assess the full scope of the incident.

Rapid containment helps limit additional damage, but third-party breaches often require extensive review of access policies and vendor relationships.

Broader Supply Chain Risk

The ManoMano data breach underscores the persistent risks associated with supply chain and vendor access. Many large platforms rely on subcontractors for customer service, logistics, or technical operations. Each integration introduces potential exposure points.

Organizations must enforce strict access limitations for third-party providers and apply continuous monitoring to detect anomalies early. Regular audits and credential management policies reduce the likelihood of credential misuse.

Customers should treat unexpected emails or calls with caution, especially those referencing past support cases. Verifying communications through official channels lowers the risk of follow-up scams.

Conclusion

The ManoMano data breach affected tens of millions of customers after attackers exploited third-party access. Although the company reported no compromise of passwords or payment details, the exposure of personal contact information still presents meaningful risk. This incident highlights the importance of rigorous vendor security oversight and proactive monitoring to protect customer data at scale.