Outfittery hacked? “Please update your payment details” Phishing emails circulating

Customers and prospective customers of the styling service Outfittery are currently receiving suspicious emails. These emails urge users to update their payment information. This is a phishing email – do not click on any links and delete the email immediately!

Phishing emails are now a daily occurrence. They are usually recognizable by poor writing style, suspicious links, or altered sender addresses. Email providers' spam filters are also quite adept at detecting them using various technologies. In this case, however, everything seems legitimate: the sender address, the link address, and even the name are personalized. Since neither Outfittery nor any other media outlets have provided any information about this, we investigated further.

Abstract: The email requesting a change to payment details is a phishing attempt. Do not click on any links and delete the email immediately. The following subject lines are used:

• "Please update your payment details"
• “Important Notice: Please Update Your Payment Details”

with the sender addresses:

• "[email protected]"
• "[email protected]"

and this or similar email text:

Emails appear to originate from legitimate servers.

Below is a technical analysis for those interested.

A look at the email headers reveals which server sent the emails. In this case, they originate from "mx.stylist.outfittery.com", a legitimate mail server belonging to Outfittery. SPF, DKIM, and DMARC are all set to "Pass," which legitimizes the server's sending rights. This also means that many spam filters will not detect this email, and it will therefore land in the inbox, as everything is technically sound. The IP address belongs to "SendGrid," a service used by many companies for sending newsletters and emails.

Looking at the link target, it also points to a legitimate domain, "lnk.stylist.outfittery.com" – and here again, "Stylist" appears. It therefore almost seems as if this tool, or rather, Outfittery's access to the external service "SendGrid," is connected.proWe have been informed. This does not mean that we are claiming Outfittery itself has been hacked. Nor do we know, and cannot say, whether customer data has been compromised.

There's also a discussion on Reddit now. posting about that.

Beware of phishing: Do not enter any data!

Clicking the link redirects you to the phishing site "https://l00ginse1tuponline[.]net", where payment information is stolen. At this point, you should close your browser window and cancel the process. If you have already entered payment information, you should immediately inform your bank or, if you have entered login credentials, change all associated passwords immediately. It is generally advisable to avoid this site. Password Manager to set different login details for each website.

Statement from Outfittery

Update on December 23, 2025: Following our request for comment, OUTFITTERY responded today. The response we received was the following, uninformative answer:

Thank you for your message.

We understand you would like more information about how this situation arose. To clarify, this was a phishing attempt, a common form of online fraud where third parties try to impersonate trusted brands to collect personal information. In this case, the attackers created a fake website resembling OUTFITTERY.

Phishing is based on imitation and deception, and unfortunately, these techniques can target any online service and its users. Our team is actively monitoring the situation and taking measures to block all related fraudulent activity.

Wenn Sie weitere Fragen haben, können Sie sich gerne an uns wenden.