---
title: "Data breach at Carrefour"
description: "Carrefour notified some of its customers that a security incident at one of its service providers had exposed their contact information. The incident has been linked to the cyberattack that hit Shipup, a parcel-tracking platform used by many retailers, via a vulnerability in the Metabase software. T"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-26-carrefour
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-26
dateModified: 2026-09-26
---
# Carrefour

Data breach — Moderate

Carrefour notified some of its customers that a security incident at one of its service providers had exposed their contact information. The incident has been linked to the cyberattack that hit Shipup, a parcel-tracking platform used by many retailers, via a vulnerability in the Metabase software. The exposed data is limited to first name, last name, email address and phone number; Carrefour states that no banking data or passwords were compromised. The exact number of affected customers has not been disclosed.

The combination of name, email and phone number enables targeted phishing attempts impersonating Carrefour.

| Fact | Value |
| --- | --- |
| Disclosed on | September 26, 2026 |
| Sector | Retail |
| Country | France |
| Cause | Third-party provider |
| Severity | Moderate |
| Status | Confirmed |

## Exposed data

- Full name
- Email address
- Phone number

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Carrefour (Shipup)](https://frenchbreaches.com/alertes/carrefour-shipup-muixw7rd535cstgrh65) — FrenchBreaches
- [Carrefour : les données de clients piratées chez un prestataire](https://rotek.fr/carrefour-les-donnees-de-clients-piratees-chez-un-prestataire/) — Rotek
- [Carrefour : fuite de données chez un prestataire touchant ses clients](https://fuitesinfos.fr/article/2026-09-26-carrefour) — Fuites Infos
- [Carrefour : des données clients exposées après la cyberattaque de son prestataire](https://www.cyberattaque.org/carrefour-des-donnees-clients-exposees-apres-la-cyberattaque-de-son-prestataire/) — Cyberattaque.org
- [Fuite Shipup : une faille chez un prestataire expose les clients de Carrefour, Printemps et Micromania](https://lelabtechnique.fr/fuite-shipup-une-faille-chez-un-prestataire-expose-les-clients-de-carrefour-printemps-et-micromania/) — Le Lab Technique
- [Fuite Shipup : quand une faille chez un prestataire expose les clients de Printemps, Micromania et Aroma-Zone](https://blog.ostraca.fr/blog/fuite-shipup-metabase-cascade-sous-traitant-2026/) — Ostraca

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-26-carrefour
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees