Information about an incident involving NAVI Shop order data

In short

Unfortunately, some NAVI Shop order data has been accessed by third parties. Payment cards and passwords were not affected. Below we explain what happened, what we have done and what to watch out for.

What happened

NAVI Shop uses third-party software for internal sales analytics. In late August 2026, an attacker exploited a vulnerability in this software and copied the store’s order table for 2020-2026. We learned of the unauthorised access on 19 October 2026, when this data appeared for sale online. If you placed an order on shop.navi.gg between 2020 and the end of August 2026, this may concern you.

What data was exposed?

We have confirmed that the exposed data includes: email, phone number, delivery country and city, order number, date and amount, payment and delivery method, promo code.

We have not been able to verify this, but we cannot rule out that your name and order contents may also have been accessed.

What data was not exposed?

Payment card details - NAVI does not store this data.

Passwords - they were not stored in this system. Payments on the website and navi.gg accounts were not affected, so there is no need to change your password or reissue your card.

What are we doing to protect your data?

We have already fixed the vulnerability, restricted access to internal systems and introduced daily security checks. We will also notify the relevant data protection authorities shortly.

An important request

We are very sorry this happened. Please be extra careful with emails, SMS or other messages claiming to be from NAVI Shop or a delivery company. We will never ask you to pay extra via a link or to enter your card details or an SMS code. If you receive such a message, do not reply - forward it to us at [email protected].

Questions?

For any questions, or to exercise your data protection rights, contact us at [email protected].