363,000 customers affected by data leak at Airsoft-Entrepot

On 21 March 2026, Airsoft-Entrepot — a French online retailer specialising in airsoft replicas and equipment — was reported to have suffered a major data breach after a threat actor advertised its customer database for sale on a hacking forum. The actor, operating under the alias "HexDex", published sample records and proof links to demonstrate authenticity. The leak reportedly spans 13 years of activity, from 2013 to 2026, and covers around 363,000 unique customers and some 2.9 million orders.

According to reporting on the listing, the breach was the result of unauthorised access to the retailer's backend database, exposing not only customer information but a large portion of the company's operational records, including invoices, B2B order data and accounting and inventory files.

The exposed data is reported to include:

• Full names
• Email addresses (around 328,000)
• Postal addresses (around 333,000)
• Phone numbers (around 243,000)
• Order histories, product details and purchase dates
• B2B order records, invoices and supplier/delivery information

As of disclosure, the breach had not been officially confirmed by the company, and the data was being offered for sale rather than publicly dumped, leaving the incident ongoing with no published remediation or CNIL statement.