Leak at Auchan

On 21 August 2025, Auchan — one of France's largest supermarket and hypermarket retailers — disclosed a cyberattack that exposed the personal data of several hundred thousand customers enrolled in its Waaoh loyalty program. The company began notifying affected customers and reported the incident to France's data-protection authority, the CNIL.

The retailer did not publicly detail the attack vector. It stressed that the exposed information was limited to loyalty-account profile data and that more sensitive fields were not compromised.

Data exposed included:

• Title (civility), surname and first name
• Email address
• Postal address
• Phone number
• Loyalty (Waaoh) card number
• Customer status

Auchan stated that bank details, passwords and loyalty-card PIN codes were not affected. In response, it deactivated the loyalty cards of impacted customers, who had to obtain a new Waaoh card in-store to recover their rewards balance. The company also warned recipients to be vigilant against phishing, noting it would never request login details, passwords or PIN codes by email, SMS or phone. This was the second customer-data breach at Auchan in under a year, following a November 2024 incident that affected more than 500,000 loyalty customers.