Skinners, the footwear company run by Skinners Technologies LLC of Jacksonville, Florida, has notified customers that their order details were exposed in a breach at ShipMonk, the fulfillment partner that handles its shipments. The company told the New Hampshire Attorney General about the incident on October 12, 2026, and reported that approximately 2,630 people were affected in total.
Customers who simply bought a product online rarely expect their name, address, and phone number to be exposed through a company they have never dealt with directly. Here is what the notice says, and what it does not.
Skinners’s Data Breach Investigation
Skinners sells its footwear through its own online shop and relies on ShipMonk, a third-party fulfillment company, to store customer order records and ship products. According to the notice to customers, ShipMonk told Skinners on August 10, 2026 that an unauthorized third party had exploited a vulnerability in an analytics platform that ShipMonk uses. Through that weakness, the third party reached certain customer order records held in ShipMonk’s systems.
The notice places the unauthorized access between May 10, 2026 and August 8, 2026. That is a window of about three months during which order records could be viewed without permission, and it ended two days before Skinners says it was told. The company reported the incident to the New Hampshire Attorney General on October 12, 2026, and that filing states that approximately 2,630 individuals were affected in total, including 17 New Hampshire residents.
The incident did not begin inside Skinners’ own systems. It involves a vendor in the supply chain, and that detail matters. When a retailer hands customer records to a fulfillment partner, those records live in the partner’s systems, and a weakness in any tool the partner uses, including an analytics platform, can open a door to data the customer shared with the retailer. Customers have no practical way to see or evaluate those arrangements before they order.
The notice says the data involved was limited to delivery information. It also states that Skinners does not store, and that ShipMonk did not have access to, credit card details, bank account numbers, or account passwords, and it describes customers’ financial information as safe. That is the company’s own description, and it is a meaningful difference from breaches that expose payment data or government identification numbers.
The notice does not offer credit monitoring, and it warns that affected customers face an increased risk of targeted phishing. That warning deserves attention. Even when no financial data is taken, a list that ties a real name to a real address, phone number, email address, and order number is exactly what a scammer needs to write a convincing message. A fraudulent text or email that mentions a recent order, or uses the correct name and address, can look entirely legitimate.
There is also a long gap between the end of the access window and the public notice. ShipMonk’s access window closed on August 8, 2026, Skinners says it learned of the problem on August 10, 2026, and the regulator filing followed on October 12, 2026. People who ordered during the exposure period may have spent weeks unaware that their details were in the wrong hands, which is one reason to stay careful about unexpected contact that references a purchase.
Questions that remain open include how the vulnerability was found and used, how long ShipMonk kept older order records, and whether stronger safeguards on the analytics platform would have prevented the access. Those are the kinds of questions that data breach claims often examine: whether an organization, and the vendors it chooses, used reasonable security to protect the information entrusted to them, and whether they responded promptly once a problem was found.
Anyone who bought from Skinners during the affected period should watch for the notice and read it carefully. Verify any message about an order by going to the company’s official website directly rather than clicking a link or calling a number in an unexpected message. If a message asks for payment details, passwords, or a verification code in connection with this incident, treat it as a scam.
People who believe they were affected may also have legal options. A class action can allow many affected people to pursue claims together rather than each person acting alone, which can be a practical path when each person’s individual losses are modest but the shared exposure is real.
When Did This Breach Occur?
According to the notice, the unauthorized access took place between May 10, 2026 and August 8, 2026. ShipMonk informed Skinners of the problem on August 10, 2026, and Skinners reported the incident to the New Hampshire Attorney General on October 12, 2026.
The timeline shows three separate dates: when the access happened, when Skinners was told, and when the regulator was notified. Anyone who ordered from Skinners between May and early August 2026 may be among the people whose order records were reachable.
What Information Was Breached?
The notice lists first and last name, shipping address, email address, phone number, and order number as the information involved. These are the details used to deliver an order.
The company states that it does not store credit card details, bank account numbers, or account passwords, and that ShipMonk did not have access to them. It describes customers’ financial information as safe.
Delivery details are still useful to scammers. Names combined with addresses, phone numbers, and order numbers can make a phishing text or email look like it came from the company, so be skeptical of any message that mentions a recent order.
What You Can Do
If you received a notice from Skinners or ordered from the company during the affected period, consider these steps:
- Read your notice carefully and keep it with your records.
- Be wary of unexpected texts, emails, and calls that mention an order, a delivery problem, or a refund, even if they use your correct name and address.
- Do not click links or call numbers in unsolicited messages. Go to the company’s official website directly instead.
- Never share passwords, payment details, or one-time verification codes with someone who contacts you about this incident.
- Request your free credit reports from Equifax, Experian, and TransUnion through annualcreditreport.com and look for accounts you do not recognize.
- Think about placing a free fraud alert or security freeze on your credit file with each of the three credit bureaus.
- Report suspected fraud to the Federal Trade Commission at ReportFraud.ftc.gov and to your state attorney general.
File a Data Breach Lawsuit Against Skinners
People whose personal information was exposed in a vendor breach may be able to bring a claim against the organizations responsible, particularly if reasonable security steps were not taken or notice was delayed.
If you were notified that your information was involved in the Skinners incident, it may be worth speaking with a lawyer about your options. Keep your notice and any records of scam messages, fraud, or time and money spent dealing with the fallout.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
