Almeida Law Group is investigating a data breach at Informa Canada Inc. dba Shop FAN EXPO (“Shop FAN EXPO”). The breach occurred on 6/19/2025 – 5/7/2026 and was discovered on 05/07/2026. If you were affected, contact Almeida Law Group.
About Informa Canada Inc. dba Shop FAN EXPO (“Shop FAN EXPO”)
Shop FAN EXPO (shopfanexpo.com) is the official online merchandise store for FAN EXPO HQ, selling authenticated fandom autographs, comic books, Funkos, and pop culture collectibles. FAN EXPO HQ is a unit of the Informa Connect division of Informa plc, a multinational events company that hosts over 17 annual pop culture fan conventions across North America. Informa Canada Inc. is headquartered in Toronto, Ontario, Canada. Because Shop FAN EXPO operates as an e-commerce checkout platform, customers who placed or attempted to place orders on the site provided payment card details and personal contact information — the types of data at risk in this incident.
What Happened?
Shop FAN EXPO was listed in a Maine Attorney General data breach filing reported on June 5, 2026. According to that filing, the incident was an external system breach involving hacking. Specifically, unauthorized code was installed on shopfanexpo.com and designed to capture information entered by customers during the checkout process. The unauthorized code was active between June 19, 2025 and May 7, 2026 — a period of nearly 11 months — before it was discovered on May 7, 2026. Upon learning of the issue, Shop FAN EXPO disabled the ability to make purchases on the site and engaged third-party cybersecurity experts to investigate. Consumer notification letters were sent on June 5, 2026. A total of 2,290 individuals were affected. The compromised information potentially includes name, address, phone number, email address, payment card number, expiration date, and card verification code (CVV). Both completed and attempted purchases during the relevant period may have been affected. No identity theft protection services were offered to affected individuals.
This attack pattern is consistent with web skimming — sometimes called a Magecart-style attack — in which malicious JavaScript is injected into an e-commerce checkout page to intercept payment card data in real time as customers enter it. The Shop FAN EXPO site runs on OpenCart, an open-source e-commerce platform. No specific threat actor has been publicly attributed to this incident, and no prior breaches or public litigation connected to this incident were found.
Key Facts at a Glance
- Company or Organization: Informa Canada Inc. dba Shop FAN EXPO (“Shop FAN EXPO”)
- Industry: E-commerce / Pop culture merchandise and collectibles retail (subsidiary of events/conventions company)
- Location: Informa Canada Inc., Toronto, ON, Canada
- Incident type: External system breach (hacking); web skimming / unauthorized checkout code
- Date of breach: June 19, 2025 – May 7, 2026
- Date breach discovered: May 7, 2026
- Date of consumer notification: June 5, 2026
- Total persons affected: 2,290
- Identity theft protection offered: No
- Source: Maine AG Data Breach Filing; Web skimming background – Wikipedia; FAN EXPO HQ – Official site
What Should You Do?
If you received a notice from Shop FAN EXPO, you should immediately review your payment card statements for any unauthorized charges and report suspicious activity to your card issuer — payment card rules generally protect cardholders from liability for unauthorized charges reported promptly. Consider placing a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion) to make it harder for identity thieves to open new accounts in your name. You can request free credit freezes directly from each bureau at no cost. You are also entitled to a free annual credit report from each bureau at AnnualCreditReport.com or by calling 1-877-322-8228. If you notice unfamiliar accounts or activity, you can report identity theft and get a personalized recovery plan at IdentityTheft.gov.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
