Blissim
CriticalReportedRetail
On 18 October 2026, a threat actor claimed to have published on a cybercrime forum a 688 MB archive attributed to Blissim, a French beauty box and online cosmetics retailer. According to the claim, the file holds 1,916,599 rows, including 399,236 payment records and 97,187 records containing a name. The sample shows the cardholder's name, the last four digits of the card, its expiry date, card type, payment method, technical payment identifiers and subscription information. It shows neither a full card number nor a security code. Blissim has not commented so far, the origin of the data is not established, and the number of distinct customers affected is unknown.
A cardholder's name combined with the last four card digits and subscription details can make a fake payment or bank message look more credible.
- Disclosed on
- October 18, 2026
- Sector
- Retail
- Country
- France
- Cause
- Undisclosed
Exposed data
- Full name
- Banking data (IBAN, card)
- Customer ID
- Order history
You are only affected if you had an account or an order with this organisation.
What you can do
- Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact