Leak at Carrefour Mobile

On 24 April 2025, Carrefour Mobile — the Belgian mobile virtual network operator (MVNO) run by the Carrefour retail group — confirmed a data breach that exposed the personal information of roughly 64,000 customers. A file containing the data was found circulating online, and the operator notified affected customers and the data protection authorities.

Carrefour attributed the incident to a compromise affecting Carrefour Mobile and stated that no banking or payment data was involved. The exact cause was placed under investigation by an external cybersecurity firm, with reporting pointing to a breach reaching customer portal and subscriber records; the leak mainly affected Belgian (and some Italian) customers, as Carrefour Mobile no longer operates in France.

Exposed data categories reported across sources include:

• Names and dates of birth
• Phone numbers and email addresses
• Home addresses
• Customer portal passwords and security-question answers
• Subscriber numbers and IMSI identifiers
• Passport numbers (for customers who had provided them)

In response, Carrefour temporarily closed the Carrefour Mobile customer portal for maintenance, reset user accounts as a precaution, and required customers to set a new password once the portal reopened. The company stressed that the incident was limited to Carrefour Mobile and did not affect the chain's other services, and that mobile service continued to function normally.