Carrefour
ModerateConfirmedRetail
Carrefour notified some of its customers that a security incident at one of its service providers had exposed their contact information. The incident has been linked to the cyberattack that hit Shipup, a parcel-tracking platform used by many retailers, via a vulnerability in the Metabase software. The exposed data is limited to first name, last name, email address and phone number; Carrefour states that no banking data or passwords were compromised. The exact number of affected customers has not been disclosed.
The combination of name, email and phone number enables targeted phishing attempts impersonating Carrefour.
- Disclosed on
- September 26, 2026
- Sector
- Retail
- Country
- France
- Cause
- Third-party provider
Exposed data
- Full name
- Email address
- Phone number
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
- Carrefour (Shipup)FrenchBreaches
- Carrefour : les données de clients piratées chez un prestataireRotek
- Carrefour : fuite de données chez un prestataire touchant ses clientsFuites Infos
- Carrefour : des données clients exposées après la cyberattaque de son prestataireCyberattaque.org
- Fuite Shipup : une faille chez un prestataire expose les clients de Carrefour, Printemps et MicromaniaLe Lab Technique
- Fuite Shipup : quand une faille chez un prestataire expose les clients de Printemps, Micromania et Aroma-ZoneOstraca
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact