Petco Vetco Clinic Data Breach Exposes Millions of Pet Owners’ Private Files

A significant data leak at Petco has exposed sensitive customer information. The breach involved its veterinary services arm, Vetco Clinics. TechCrunch discovered the security lapse and alerted the company.Petco confirmed it is investigating the incident. The company took part of the Vetco website offline after being notified. This marks the third known data security issue for Petco this year.

Exposed Pet Medical and Owner Details Found Online

The security flaw allowed unrestricted access to customer records. Anyone could download files without a login. This was due to a common web vulnerability.According to TechCrunch, exposed files contained extensive personal data. This included customer names, addresses, and phone numbers. Pet medical histories, diagnoses, and prescription records were also accessible.Veterinary visit summaries and consent forms were found. The files also listed pet names, breeds, and microchip numbers. Costs of services and veterinarian names were included in the records.

How a Simple Website Flaw Led to a Major Breach

The problem was an insecure direct object reference. Vetco’s customer portal generated PDF documents for users. The page creating these PDFs was not password-protected.A sequential customer ID number was used in web addresses. By changing this number, anyone could access another customer’s file. TechCrunch’s checks suggest millions of records were potentially retrievable.One exposed record was indexed by Google. That specific file was dated from mid-2020. It is unclear how long the data was publicly accessible.Petco spokesperson Ventura Olvera addressed the issue. The company stated it has implemented additional security measures. Petco did not provide evidence or details on whether data was stolen.

 

Third Major Security Incident for Petco in 2025

This is the third data breach reported for Petco this year. Earlier, hackers associated with Scattered Lapsus$ Hunters hit the company. They allegedly stole data from a Petco Salesforce database.In September, Petco disclosed another separate data leak. It involved a software setting that made files accessible online. That breach included Social Security numbers and financial information.California law requires disclosure for breaches affecting over 500 state residents. Olvera declined to specify how many were affected by the September event. TechCrunch confirms this Vetco leak appears to be a new, distinct incident.

Google Cuts AI Cost in India with New AI Plus Plan Launch

The latest Petco data breach highlights ongoing vulnerabilities in how companies protect customer information. Millions of pet owners’ private details were left exposed on the web. This series of security failures demands stronger safeguards for sensitive consumer data.

Thought you’d like to know

What information was exposed in the Petco Vetco breach?

Exposed files contained owner names, addresses, and phone numbers. They also included detailed pet medical histories, vaccination records, and veterinary visit summaries.

How was the Petco customer data accessed?

The data was accessed via a website flaw called an IDOR. The system did not verify user permissions, allowing anyone to view files by changing a customer ID number in a web link.

Has Petco experienced other breaches recently?

Yes. This is the third major data security incident Petco has faced in 2025. Previous breaches involved hacker theft and a separate software misconfiguration.

What should affected Vetco customers do now?

Customers should monitor their accounts and credit reports for unusual activity. They should be wary of phishing attempts using their exposed personal or pet’s information.

Did Petco notify customers about this breach?

Petco has not yet issued public notifications about this specific Vetco incident. The company stated it is investigating after being alerted by TechCrunch.