Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Luxottica confirmed in 2023 that customer data held by a third-party contractor had been exposed and posted online. The company said its own systems were not breached. The “70 million” figure is a rounded headline description: analyses counted database lines, unique email addresses and accounts differently, and none establishes how many individual people were affected.
What happened—and when
On May 19, 2023, BleepingComputer reported that Luxottica confirmed a security incident involving customer data held by a third-party contractor. The company said it first learned of the incident from a third-party post on the dark web in November 2022. Analysis of the dataset by D3Lab researcher Andrea Draghetti identified March 16, 2021 as the likely date of exfiltration, based on the most recent records. The data appeared in free releases on hacking forums in April and May 2023.
These are three different points in the timeline: the likely date data was taken, the company’s reported discovery, and the later public posting. Luxottica said its own systems had not been breached, while confirming that customer information held by a contractor was exposed. The incident therefore involved a third party’s handling of customer data, not a reported intrusion into Luxottica’s systems.
In the statement quoted by BleepingComputer, Luxottica said it had notified the FBI and Italian police and that the Italian data protection authority had been notified. The company also said its investigation was ongoing. Those are the company’s reported actions and assessment, not independently verified findings by law enforcement.
#1 Best Overall
What information was exposed?
Luxottica said the dataset primarily contained customer names, physical addresses, phone numbers, email addresses and dates of birth. It said the data did not include financial information, Social Security numbers, login data or passwords. That description reflects the company’s assessment while its investigation was ongoing in 2023; it should not be read as an independently verified inventory of every record.
Mozilla Monitor’s Luxottica breach entry, which credits Have I Been Pwned for the breach data, lists names, physical addresses, phone numbers, email addresses, birth dates and genders.
Why do reports give different breach totals?
The counts describe different things, so they should not be added together or treated as interchangeable estimates of affected people.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Reported figure | What it counts | Source and context |
|---|---|---|
| 70 million | Rounded headline shorthand, not a precise count of unique people | BleepingComputer, May 19, 2023 |
| 305 million | Database lines; lines are not unique people | Andrea Draghetti/D3Lab, as reported by BleepingComputer in 2023 |
| 74.4 million | Unique email addresses, after deduplication | Andrea Draghetti/D3Lab, as reported by BleepingComputer in 2023 |
| 77,093,812 | Unique accounts | Troy Hunt, Have I Been Pwned, as quoted by BleepingComputer in 2023; the report said 74% were already in HIBP’s records at that time |
| About 77.1 million | Accounts, rounded for display | Have I Been Pwned’s current Luxottica listing, checked October 5, 2026 |
A database can contain repeated records, and one person can have multiple email addresses or accounts. The sources do not establish a verified count of unique individuals. The most careful summary is that the leak contained tens of millions of accounts, with reported totals varying according to the unit counted.
How to check whether your email appears in the breach
- Open Mozilla Monitor’s Luxottica breach entry or the Luxottica listing on Have I Been Pwned.
- Use the service’s email lookup to check the address you may have used with Luxottica or an associated retailer.
- If the service reports a match, treat it as evidence that the address appears in that breach-notification dataset—not proof that someone misused it or that every listed field was attached to your record.
A lookup result does not identify who accessed a record, and an address that does not match cannot establish whether other information about you was exposed under a different address. The services provide a way to check breach records, not a complete investigation of an individual’s data.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Do not confuse this leak with the separate 2020 scheduling-app case
A different Luxottica incident involved unauthorized access from August 5–9, 2020 to an eye-appointment scheduling application used by certain Luxottica-affiliated U.S. eye-care practices. It involved certain LensCrafters, Pearle Vision, Target Optical and affiliated practices. The court-authorized settlement site says Luxottica determined that information belonging to as many as 829,454 individuals may have been affected. Plaintiffs alleged that personal and health information could have been accessed; Luxottica denied wrongdoing, and the settlement was not an admission.
This scheduling-application case is separate from the 2021 third-party-contractor dataset. The court entered final approval of the 2020 class settlement on January 28, 2025, and the settlement site lists January 2, 2025 as the claim deadline. That deadline has passed; the settlement does not cover the later leak.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
