Cyberattack at Carrefour: revelations about a possible data leak affecting 13 million customers

© Carrefour

A new threat is looming over the French cybersecurity landscape. This Tuesday, an announcement published on the social network X has caused trouble in the mass retail sector. A mysterious hacker, presenting himself under the pseudonym “LaFouine”, claims to have got his hands on a massive database containing the personal information of millions of Carrefour customers. This revelation comes in an already tense context for French companies, which have been facing a surge in cyberattacks in recent months.

Cybersecurity specialist Clément Domingo quickly relayed the information on X, propelling the case to the forefront of the media scene. According to initial analyses, the allegedly stolen data includes a full range of sensitive information: names, first names, postal addresses, telephone numbers, emails, dates of birth, and even the purchasing preferences of the customers concerned. A breach that, if confirmed, would constitute one of the largest personal data leaks in France this year.

A two-stage reaction at Carrefour

Faced with this potential threat, Carrefour initially adopted a cautious approach. In an initial press release, the group confirmed that it had been “informed” of a “possible” cillegitimate connection to “one of their IT systems or that of one of their partners”. A measured response that quickly evolved after an in-depth analysis of the situation.

The group's cybersecurity teams immediately launched a full investigation of their IT infrastructures. The results of these checks allowed Carrefour to radically change its position. “The checks allow us to confirm that Carrefour's systems were not the subject of an illegitimate connection and that our customers' data was not compromised “, the group declared in a second, more affirmative press release.

Persistent gray areas

The affair takes an even more intriguing turn with the hacker's statements. “LaFouine” claims to have a “surprise” that he promises to reveal in the coming days. A classic intimidation tactic that nevertheless raises questions about the credibility of his allegations.

Several elements indeed cast doubt on the authenticity of this cyberattack. The recently created profile of “LaFouine” on the dark web has cybersecurity experts concerned. Clément Domingo himself emphasizes that there is “no certainty about the veracity of this database.” The unusual format of the information presented and the absence of tangible evidence reinforce these suspicions. This case is part of a broader wave of cyberattacks targeting large French companies. Free Mobile, in particular, suffered a major data leak affecting nearly 20 million subscribers. A case that recently came to a head with the arrest and referral to court of the main suspect.