Customer data exposed in a shipping provider incident
Summary
ShipMonk, one of the fulfilment providers that stores and ships Ekster orders, has told us that an unauthorised party gained access to systems holding customer order data. The information involved includes names, shipping addresses, phone numbers and email addresses. No payment card details, passwords or Ekster account credentials were involved, and Ekster's own systems were not compromised. Customers whose details were involved may see an increase in phishing emails, texts and calls.
This may affect orders shipped to [LIST AFFECTED COUNTRIES] between [START DATE] and [END DATE]. We have emailed everyone affected directly from [NOTIFICATION EMAIL ADDRESS]. If you did not receive that email, your details were not part of this incident.
[What changed since first publishing, and what you are still verifying.]
What happened
On [DATE WE WERE NOTIFIED], ShipMonk — the third-party logistics partner that stores our products and ships orders to customers in [REGIONS] — informed us that an unauthorised party had accessed systems containing customer data. Their investigation is ongoing, and we are working with them directly to establish exactly what happened.
We are genuinely sorry. Customer personal information, including full names, phone numbers, email addresses and shipping addresses, was accessed by someone who had no right to it. Based on what ShipMonk has confirmed so far, this affects [NUMBER] customers whose full details were involved, and [NUMBER] customers whose exposure was limited to [LIMITED FIELDS].
To be clear about the boundaries of this incident: Ekster's own systems, website and accounts were not compromised. ShipMonk holds shipping information because it is what a courier needs to physically deliver a parcel to your door — nothing more. The contents of your order were not exposed, and your product is unaffected.
Everyone affected has been contacted individually by email from [NOTIFICATION EMAIL ADDRESS]. If you did not receive an email from that address, you were not affected by this incident.
What data was involved
Your notification email states which of the two categories you fall into. Here is the full picture of what a fulfilment partner holds, and what it never has access to.
What was exposed
- Full name
- Shipping address
- Phone number (required by delivery couriers)
- Email address
- Order number
What was NOT exposed
- Payment card or bank details
- Ekster account passwords
- Government ID or date of birth
- The contents of your order
- Tracker or Find My location data
Payments on ekster.com are handled by our payment processor and never reach a fulfilment partner, which is why no card details were involved.
How to protect yourself
The practical risk here is impersonation. With your name, address, phone number and order details, a scammer can send a message that looks convincingly like it came from Ekster or from a delivery company — because it contains real information only a legitimate sender should know. Please treat unexpected messages about your order with suspicion for the next few months.
Signs of a scam to watch for
- A text or email asking you to pay a small "customs charge", "redelivery fee" or "address correction fee" to release a parcel.
- An order confirmation for something you did not buy, with a link or phone number to "cancel" it.
- A phone call from someone claiming to be Ekster support who asks you to confirm card details or read out a code.
- An offer of a refund, compensation or free replacement that requires your bank details.
- A link to a login or checkout page on a domain that only looks like ours — check the address bar carefully.
- Any message that pressures you to act immediately.
Ekster will never ask you for your full card number, your CVV, your bank login, or your account password — not by email, not by text, and not over the phone. We will never ask you to pay a fee to release a parcel. Genuine Ekster emails only ever come from an @ekster.com address. If anything feels off, do not use the links in the message: go to ekster.com directly and contact us there.
What we are doing about it
We chose this partner and we are accountable for that choice, so here is what is actually happening rather than a general reassurance.
Rather than relying on you finding this page, we emailed every affected customer individually and told them specifically which of their details were involved.
We are in direct contact with ShipMonk to confirm exactly which records were accessed and how. They have secured the affected systems and are hardening their security. We will update this page as we learn more.
We are auditing the data we share with every fulfilment and logistics partner, cutting it to the minimum a courier genuinely needs, and tightening how long they are permitted to keep it after delivery. [CONFIRM SPECIFICS WITH DPO BEFORE PUBLISHING.]
We have notified the relevant data protection authorities as required. [CONFIRM WHICH AUTHORITIES AND DATES WITH LEGAL BEFORE PUBLISHING.]
Our customer support team has the full picture and can help you check whether a message you received is genuinely from us. If in doubt, forward it to us before clicking anything.
Sharing less data on future orders
Shipping a physical product means some data has to travel with the parcel — a courier cannot deliver to an anonymous address. But you can reduce how much of your identity is attached to an order:
- Use an email alias rather than your primary address. Apple's Hide My Email and similar services work fine for order confirmations.
- Pay with a virtual or single-use card number if your bank offers them.
- Have the parcel delivered to a pickup point or locker instead of your home, where your courier offers it.
- Ask us to delete your saved address after delivery if you do not want it kept on file.
Your questions, answered
Who is ShipMonk, and why did they have my data?
ShipMonk is a third-party logistics partner that stores our products and ships orders to customers in [REGIONS]. To physically deliver a parcel they need your name, shipping address, phone number (couriers require one for delivery notifications) and email address. That is the only reason they hold any of your information.
How do I know whether I was affected?
If you were affected, you received an email from [NOTIFICATION EMAIL ADDRESS] telling you so, and stating which of your details were involved. If you did not receive an email from that address, your details were not part of this incident. If you are unsure whether an email you received is genuinely from us, contact our support team directly through ekster.com rather than replying to it.
Was my payment information involved?
No. Card payments on ekster.com are processed by our payment provider and card details are never passed to a fulfilment partner, so there were no card numbers in the affected systems. You do not need to cancel your card because of this incident. If someone contacts you claiming otherwise and asks for your card details, that is a scam.
Which orders are affected?
Orders shipped to [LIST AFFECTED COUNTRIES] between [START DATE] and [END DATE]. [IF THE SCOPE IS STILL BEING VERIFIED, SAY SO EXPLICITLY HERE RATHER THAN IMPLYING CERTAINTY.]
How many customers are affected?
[NUMBER] customers had their full details involved (name, email, phone number and shipping address), and [NUMBER] had a limited set of details involved ([LIMITED FIELDS]).
What should I do now?
You do not need to change anything about your Ekster account or your payment methods. The single most useful thing you can do is be sceptical of unexpected messages about deliveries, orders or refunds — especially any that ask for payment or card details. Check the sender address, and when in doubt come to ekster.com directly instead of following a link.
Should I be worried about my Ekster account password?
No passwords were involved in this incident, because a fulfilment partner never has access to them. That said, if you reuse the same password across multiple sites, changing it is always worth doing.
Does this affect my product, warranty or tracker?
No. Your product is unaffected, your warranty is unaffected, and no tracker or location data was involved. This incident concerns shipping information held by a logistics partner and nothing else.
Can I ask you to delete my data?
Yes. You can request deletion of your personal data at any time — see our [PRIVACY POLICY LINK] or contact our support team and we will handle it.
Are you still using ShipMonk?
[ANSWER HONESTLY AND SPECIFICALLY. Customers read this question as the test of whether the rest of the page is sincere. Say what the current arrangement is and what would have to change for it to continue.]
Still have questions?
If you are worried about a message you have received, or you want to know whether your details were involved, our support team will help you check. There is no wrong question here.
Contact Ekster supportWe know that trusting a company with your address and phone number is not a small thing, and that this incident happened on our watch even though it happened at a partner. We are sorry. We will keep this page updated as the investigation continues.
[NAME, ROLE] — Ekster
