French hypermarket chain Auchan says cyber attack impacted loyalty programme member data

French hypermarket chain Auchan said it experienced a data security incident that compromised the sensitive personal information of its loyalty programme customers.

 

In a notification sent to affected customers, the multinational retail group said that it has recently been a victim of a significant cyber attack that involved threat actors infiltrating its internal network and accessing the sensitive personal data of its loyalty program customers.

 

Auchan immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident. The investigation revealed that compromised data included names, email addresses, postal addresses, telephone numbers, dates of birth, loyalty card numbers, and family composition.

 

The company has, however, clarified that customers’ financial information, including banking data, passwords, and PIN codes, were not accessed by the threat actor.

 

While the hypermarket chain did not share the number of the affected individuals, according to local news, more than 500,000 customers were affected as a result of the hacking incident.

 

Auchan has notified Commission Nationale Informatique & Libertés (CNIL), or the country’s data protection agency, and is working under its guidance to resolve the situation.

 

“All the necessary measures have been taken immediately to put an end to this attack and strengthen the protection of our information systems. Through these measures we have strengthened the controls in case of derecognition of your fidelity card,” reads the notice.

 

Auchan has advised all affected individuals to remain vigilant about the “risk of fraudulent emails, SMS or calls” and report to relevant law enforcement authorities if anything suspicious is identified.

 

At the time of publishing, no known ransomware group has claimed responsibility for the cyber attack on Auchan. The hypermarket chain also did not share details on who is responsible for the cyber attack or how the threat actor infiltrated its internal network.