Atol Mon Opticien: 5.9 million customers exposed in a massive data leak

On 22 May 2026, Atol Mon Opticien — one of France's largest optical retail cooperatives, with more than 800 stores nationwide — was named in a listing posted to a cybercriminal forum offering a database said to contain the personal details of some 5.9 million of its customers. The post, attributed to a threat actor using the handle Angel_Batista, advertised the full database for 8,000 euros and included a sample of roughly 1,000 records as proof.

According to the listing, the dataset comprises 5,924,215 customer records gathered from over 800 Atol-affiliated stores, including more than 1.6 million unique email addresses. The exposed information reportedly covers entire households, including children and elderly family members.

The exposed data categories reportedly include:

• Full names, birth names and dates of birth
• Email addresses
• Phone numbers
• Complete postal addresses (with postal codes)
• Internal administrative references

The breach was part of a broader wave of attacks against French optical retailers: between 22 and 24 May 2026, customer databases from four eyewear brands — including Optic 2000 and Auchan Optique — were put up for sale on cybercrime forums, potentially exposing more than 6 million people in total. The combination of identity, contact and address data substantially raises the risk of targeted phishing, identity theft and telephone fraud. As of reporting, Atol had not publicly confirmed the authenticity or full scope of the leak, and the attack vector and origin of the data remained unknown.