Fashion retailer Express has fixed a security flaw that exposed its customers' personal data and order details to the internet. The flaw exposed order confirmation pages on Express’ online store, revealing details of purchases and who made them. The exposed information included customer names, phone numbers, email addresses, postal, billing, and delivery addresses, and partial payment card information. A security and privacy advocate discovered the flaw after investigating a fraudulent purchase on a family member's account, but found no way to report it to Express. Express has not yet disclosed plans to notify customers of the security lapse. This incident is part of a trend of incidents where customers' information was left exposed online due to misconfigurations or inadvertent security lapses.