La Mie Câline Biscarrosse: data and administrator access released publicly

On 23 April 2026, La Mie Câline Biscarrosse — a franchise outlet of the French bakery and viennoiserie chain — was the subject of a claimed breach of its internal management website. A threat actor posted on a cybercrime forum claiming to have compromised the site "in just a few minutes," and published an exported local database together with working administrator login credentials.

The intrusion appears to reflect the weak security posture typical of small local businesses, where a poorly protected internal server can be accessed without sophisticated tooling. Beyond the leaked data itself, the published admin credentials would in principle allow an attacker to log in, alter records, or pivot to further access.

The data offered in the leak reportedly included:

• Financial records such as the cash ledger ("livre de caisse"), invoices and quotes
• Customer names and postal addresses (street, postal code, city)
• Customer phone numbers and email addresses
• Customer and administrative account status
• Administrator login credentials for the internal site

No specific number of affected customers or records was disclosed. As of reporting, the authenticity of the files and credentials had not been independently confirmed, and no public statement from the business was available; the status of the incident therefore remains unknown.