Almeida Law Group is investigating a data breach at Malin + Goetz, Inc. The breach occurred on May 22nd, 2026. If you were affected, contact Almeida Law Group.
About Malin + Goetz, Inc.
Malin + Goetz is a luxury skincare, fragrance, and candle brand founded in 2004 by Matthew Malin and Andrew Goetz in the Chelsea neighborhood of New York City. The company sells directly to consumers through its website and through premium retail partners including Nordstrom, Sephora, Selfridges, and Space NK, with flagship apothecary locations in New York, Los Angeles, London, and Hong Kong. Because the company processes online purchases, customers’ payment card and personal contact information passes through its checkout system—making that data a target for web-based attacks.
What Happened?
Malin + Goetz, Inc. was listed in a California Attorney General sample breach notice filed on August 4th, 2026. According to the company’s own notice, this was a web skimming attack—sometimes called a Magecart-style attack—in which unauthorized code was injected into the checkout and payment page of malinandgoetz.com. The code was capable of capturing information entered by shoppers at the time of purchase.
On June 15th, 2026, Malin + Goetz received confirmation from a third-party service provider that its website may have been compromised. The investigation determined that the unauthorized code was active between May 22nd, 2026 and June 10th, 2026—a window of approximately 20 days. The company states it removed the unauthorized code, notified card brands and payment processing partners, and engaged specialists to monitor for any reintroduction of malicious code. The breach notice is dated August 3rd, 2026. No specific threat actor has been attributed to this incident, and no prior breaches involving Malin + Goetz were identified.
Key Facts at a Glance
- Company or Organization: Malin + Goetz, Inc.
- Industry: Cosmetics, Beauty Supply & Personal Care Products
- Location: 330 Seventh Avenue, 21st Floor, New York, NY 10001
- Incident type: Web skimming / formjacking (Magecart-style) attack
- Date of breach: May 22nd, 2026
- Date breach discovered: June 15th, 2026
- Date of consumer notification: August 3rd, 2026
- Identity theft protection offered: Experian IdentityWorks (12 months, complimentary)
- Enrollment deadline: October 31st, 2026
- Prior breach: None identified
- Litigation status: No class action or related litigation identified as of August 4th, 2026
- Source: California Attorney General sample breach notice (https://oag.ca.gov/ecrime/databreach/reports/sb24-627640); Malin + Goetz official website (https://www.malinandgoetz.com/our-story); LinkedIn (https://www.linkedin.com/company/-malin-goetz-)
What Should You Do?
If your information was involved in this breach, you should enroll in the complimentary 12-month Experian IdentityWorks membership by October 31st, 2026 using the activation code provided in your notice. Because payment card data was potentially captured, review your card account statements carefully for any unauthorized charges and report suspicious activity to your card issuer immediately. You should also place a fraud alert or credit freeze with the three major credit bureaus—Equifax, Experian, and TransUnion—to make it harder for anyone to open new accounts in your name. You can request free copies of your credit reports at AnnualCreditReport.com to check for unfamiliar accounts or inquiries. If you suspect your information has already been misused, visit IdentityTheft.gov for step-by-step guidance on reporting and recovering from identity theft.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
