Fashion Retailer Express Left Customers' Personal Data and Order Details Exposed to the Internet (2 minute read)

2026-04-17

Express exposed order confirmation pages that leaked customer names, contact details, addresses, order contents, and partial card data, using easily guessable sequential order numbers. The bug was found by Rey Bango while probing a fraudulent order and confirmed by TechCrunch, then patched after they notified Express.