Acrimed: online shop hit by a cyberattack

On 29 April 2026, Acrimed — the French media-criticism association Action Critique Médias, which runs an online shop to fund its activities — informed its users that its e-commerce site had been hit by a cyberattack that compromised some customer personal data.

According to the association's notice, the intruders gained access to data held by the online store. The exposed information was limited to:

• Email addresses
• Encrypted (hashed) passwords
• Purchase / order history

Acrimed stated that more sensitive details — full names, postal addresses, phone numbers and banking information — were not affected by the breach.

In response, the association temporarily took its online shop offline to investigate the incident and reinforce its security, and it deleted dormant accounts dating from 2017 or earlier as a precaution. The breach was reported to France's data-protection regulator (CNIL). The number of affected customers was not disclosed. Acrimed warned users of follow-on risks — particularly credential reuse on other sites, targeted phishing impersonating the organization, and spam — and urged them to change any reused passwords.