Petco Vetco Clinics Expose Customer and Pet Data in Latest Security Lapse Petco has taken part of its Vetco Clinics website offline after a security flaw exposed sensitive customer and pet records to the open web. The incident, discovered by TechCrunch and reported to the company on Friday, allowed unauthorized access to medical histories, prescription details, and personal information without requiring login credentials. The exposed records included customer names, addresses, emails, phone numbers, clinic visit locations, veterinary assessments, and financial details. Pet data—such as names, breeds, ages, microchip numbers, and medical vitals—was also compromised. At least one record, dated mid-2020, was indexed by Google, making it publicly searchable. The vulnerability stemmed from an insecure direct object reference (IDOR) flaw in Vetco’s PDF-generating system. The portal, hosted at petpass.com, lacked proper authentication, enabling anyone to access files by manipulating customer ID numbers in the URL. Since these IDs are sequential, millions of records may have been exposed. TechCrunch confirmed the issue by testing intervals of 100,000 customer numbers. Petco acknowledged the breach in a statement on Tuesday, stating it had implemented additional security measures but did not confirm whether logs could determine if data was exfiltrated. The company declined to comment on the duration of the exposure. This marks Petco’s third reported data breach in 2025. Earlier incidents included a ransomware attack by the Scattered Lapsus$ Hunters hacking group and a separate leak in September involving Social Security numbers, driver’s licenses, and payment card details. The latest Vetco incident appears unrelated to the prior breaches.

Petco Faces Class Action Lawsuit Over Data Breach Exposing Customer Personal Information A class action lawsuit filed in the U.S. District Court for the Southern District of California alleges that Petco failed to adequately protect customer data, leading to a breach that compromised sensitive personal information. The suit, Mack, et al. v. Petco Animal Supplies Stores Inc. (Case No. 3:25-cv-03806), was brought by plaintiff Matthew Mack, who claims the company neglected to implement proper cybersecurity measures despite knowing the risks. The breach, discovered during a routine security review in July 2025, exposed a range of personally identifiable information (PII), including names, dates of birth, Social Security numbers, driver’s license numbers, and financial details such as account and payment card numbers. According to the lawsuit, affected customers were not notified of the incident for months, leaving them unaware of the exposure. Mack’s legal team, represented by Lynch Carpenter LLP, accuses Petco of negligence, breach of implied contract, and unjust enrichment, among other claims. The plaintiff seeks declaratory and injunctive relief, as well as damages, on behalf of a nationwide class of consumers impacted by the breach. The lawsuit highlights Petco’s alleged failure to meet basic security standards, despite handling highly sensitive customer data. The case underscores growing concerns over corporate accountability in safeguarding personal information amid rising cyber threats.

A Petco store pictured Sept. 2018 in Hampstead just outside of Wilmington, N.C. The pet retailer says a massive data breach hit an unspecified number of its U.S. customer base, stating it located the problem internally and "immediately took steps to correct the issue and to remove the files from further online access." File Photo by Ken Cedeno/UPI | License Photo Dec. 8 (UPI) -- Petco stated it located the problem internally and "immediately took steps to correct the issue and to remove the files from further online access." On Friday, Petco filed a legally mandated report with the Texas attorney general's office that revealed compromised data encompassed names, dates of birth, Social Security and driver's license numbers, and other financial details, including account and credit or debit card numbers. A company spokesperson told TechCrunch that Petco had provided "further information to individuals whose information was involved." It added that new digital alterations included "additional security measures and technical controls to enhance the security of our applications." Petco officials wrote in a notification letter filed with California's attorney general they discovered a "setting within one of our software applications that inadvertently allowed certain files to be accessible online." California law requires breach disclosures when 500 or more state residents are affected, indicating Petco's cyber incident met or exceeded that threshold. In addition, the pet co