Fashion retailer Express has patched its website after a security vulnerability allowed anyone to view other customers’ order details and personal information. At least 12 customer orders were publicly listed on web search engine results.

The flaw exposed sensitive data, including names, phone numbers, email addresses, delivery addresses, purchase items, and card type details with the last four digits visible. Express is now run by WHP Global, a company that owns several fashion retailers.

Rey Bango, a security advocate, discovered the issue while investigating a fraudulent purchase on a family member’s account but could not report it to Express directly. TechCrunch was asked to alert the company to ensure the bug was fixed.

Express’s CEO, Joe Berean, stated that they take customer information seriously and are reviewing the matter. However, he did not provide details on how customers can contact them or if plans exist for a vulnerability disclosure program. The incident highlights recent security lapses where companies have exposed customer data due to misconfigurations.