812,000 Boulangerie Ange customers affected by a data leak

On 8 May 2026, Boulangerie Ange — a French bakery chain founded in Aix-en-Provence and operated by the Bilov group — confirmed a data breach affecting roughly 812,000 customers registered on its digital services. The leak had first been advertised on 29 April 2026 by a threat actor using the handle "odelpaso" on a cybercrime forum.

According to reporting on the incident, the breach stemmed from an active authentication token left exposed on a company subdomain, which let an attacker make unauthorized API calls and extract the customer database. No payment or banking information was included in the exposed dataset.

The data exposed covered:

• Last names and first names
• Phone numbers
• Cities of residence

Boulangerie Ange (via the Bilov group) acknowledged the incident and notified affected customers by email. Although no financial data was leaked, the exposed contact details put customers at heightened risk of phishing, fraudulent calls and SMS, spam, and cross-referencing with other breached databases.