1,457,473 orders affected by claimed leak at Florajet

On 3 March 2026, Florajet — one of France's leading online flower-delivery networks — confirmed that an attacker had gained unauthorised access to its B2B ordering tool, after a corpus of 1,457,473 order records (roughly 136 GB, covering the 2023-2026 period) was put up for sale on a cybercrime forum.

The intrusion was reportedly enabled by compromised login credentials belonging to a partner florist, a weak link in the platform's supply chain. The attacker — operating under the alias HexDex, a threat actor that has repeatedly targeted French companies — was able to harvest order vouchers stored as PDF documents and exfiltrate them in bulk.

The exposed data included:

• Sender and recipient first and last names
• Complete postal delivery addresses (around 1.2 million)
• Phone numbers (approximately 952,000 unique numbers)
• Order and purchase details
• The personal messages accompanying each bouquet — an unusually intimate category containing declarations of love, apologies and condolences

Florajet acknowledged the breach, blocked the malicious access, and said it would shorten the retention period for these documents. The intimate nature of the leaked messages, combined with names, addresses and phone numbers, raises a heightened risk of targeted phishing and fraud against affected customers and recipients.