Security notice
Did you shop at Our Second Nature? The Singapore clothing brand says customer details in its sales records were accessed, and has not published a count.
Our Second Nature, a Singapore clothing brand, emailed customers on November 8, 2026 about a data security incident it discovered on November 6. The Straits Times, which saw the email, reported that an unauthorized third party breached the company's backend sales records. Compromised information may include customers' names, email addresses, contact numbers, dates of birth, delivery addresses and purchase-related information. The company said credit card details were not compromised because it does not store them on its systems. On November 13 it told the newspaper that the full circumstances and extent of the breach were still being investigated, that it had notified Singapore's Personal Data Protection Commission (PDPC), and that it is cooperating with the authority. PDPC said the same day that it is aware of the incident and investigating. The company has not published a count. This is not a named software flaw, so there is no CVE or patch to install. If you shopped at Our Second Nature, watch for phishing and use official pages. (The Straits Times, Nov 13)
What happened
- Discovered on November 6, emailed to customers on November 8. The Straits Times reports that Our Second Nature, a Singapore clothing brand, discovered a data security incident on November 6 and emailed customers on November 8. The newspaper saw that email. It says an unauthorized third party breached the company's backend sales records. (The Straits Times, Nov 13)
- What data may have been involved. According to the email, compromised information may include customers' names, email addresses, contact numbers, dates of birth, delivery addresses and purchase-related information. (The Straits Times, Nov 13)
- Cards not stored. The company said credit card details were not compromised because it does not store these on its systems. (The Straits Times, Nov 13)
- Count unknown. On November 13, in response to media queries, Our Second Nature said the full circumstances and extent of the data breach were still being investigated. The company has not published a count. (The Straits Times, Nov 13)
- PDPC investigating. The company said it had notified Singapore's Personal Data Protection Commission and is cooperating with the authority's review. PDPC said on November 13 that it is aware of the incident and investigating. (The Straits Times, Nov 13)
- Access blocked, security tightened. The company said it took immediate steps to block further unauthorized access, tightened system security and launched an investigation, and that it is taking steps to meet its obligations under Singapore's Personal Data Protection Act. It apologized to customers and urged them to watch for phishing, use unique passwords and turn on two-factor authentication. (The Straits Times, Nov 13)
Who should worry
- You have an account with Our Second Nature, or you have shopped there and given the company your contact or delivery details.
- You run an online store and keep customer names, emails, phone numbers, dates of birth, delivery addresses or purchase history.
If you have never shopped at Our Second Nature and you do not run a store that keeps this kind of customer data, this notice does not apply to you.
What to do now
If you shopped at Our Second Nature. This follows the company's own email, as reported by The Straits Times.
- Use official pages. Go to the company's official website yourself. Do not use a link from an unexpected message. (The Straits Times, Nov 13)
- Watch for phishing. The company urged customers to guard against phishing attempts. Names, emails, phone numbers, dates of birth, delivery addresses and purchase details are enough to make a fake message look real. Do not give anyone a password, a card number or a one-time code. (The Straits Times, Nov 13)
- Use a unique password and two-factor authentication on your online accounts, as the company asked. If you reused the same password on other sites, consider changing those passwords too. (The Straits Times, Nov 13)
- Wait for the company if it has something specific to tell you. It has not published a count, and the extent is still under investigation. Do not assume your data was accessed, and do not assume it was not. (The Straits Times, Nov 13)
If you run an online store. These are general steps, not from Our Second Nature. We are not claiming any tool, including EverThread, would have stopped this attack.
- Look at the customer data you still keep, including dates of birth, delivery addresses and purchase history, not only names and emails. Delete fields you do not need.
- Know how you would tell customers if sales records were accessed, including who can approve that message, and how you would warn them about phishing.
- Know where card data lives. Our Second Nature says it does not store card details on its systems. Confirm whether your own store or payment vendor stores cards, and how you would describe that to customers.
What to send your developer, agency or host
Our Second Nature, a Singapore clothing brand, said it discovered on November 6, 2026 that an unauthorized party had accessed backend sales records, and emailed customers on November 8. Compromised information may include names, email addresses, contact numbers, dates of birth, delivery addresses and purchase-related information. The company says it does not store credit card details. It has not published a count. It notified Singapore's Personal Data Protection Commission, which said on November 13 that it is investigating. Please tell us what customer data our store still keeps, including dates of birth, delivery addresses and purchase history, which of those fields we can delete, whether we store any card details, and how we would notify customers and warn them about phishing if our sales records were accessed. Source: The Straits Times, November 13, 2026.
Common questions
Does this mean my site was hacked?
No. This notice is about a breach Our Second Nature confirmed at its own sales records. It does not mean your site was hacked. It matters to you if you shopped there, and as a store owner because many shops keep the same kinds of customer data.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see Our Second Nature's customer records, and we cannot tell you whether your account was involved.
Were credit cards stolen?
The company said credit card details were not compromised because it does not store them on its systems. (The Straits Times, Nov 13)
How many people were affected?
The company has not published a count. On November 13 it said the full circumstances and extent were still being investigated. (The Straits Times, Nov 13)
How did the attacker get in?
The company has not said. It said the full circumstances are still being investigated. (The Straits Times, Nov 13)
Is there anything to update?
No. This was an attack on one company's systems, not a named flaw in software you run. The general steps for store owners above are worth doing anyway.
Where can I follow official updates?
The Straits Times reported the incident on November 13, 2026, based on the company's November 8 customer email and its November 13 responses, and on a statement from Singapore's Personal Data Protection Commission. Watch the company's official website. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- The Straits Times: Local clothing brand Our Second Nature hit by data breach; customer details exposed, published November 13, 2026, updated November 13, 2026.