La Redoute: a logistics database of 96,000 customers tied to deliveries leaked

On 4 May 2026, La Redoute — the French mail-order and e-commerce retailer — was named in a fresh data leak after a threat actor using the alias Lagui posted online a database of roughly 96,000 customers built around the retailer's shipping and delivery operations. The actor described the dataset as the product of automated scraping across delivery-related interfaces rather than a direct intrusion into La Redoute's core systems.

La Redoute pushed back on the framing of a direct breach, stating that the exposed records in fact originate from a January 2026 security incident at its logistics partner Relais Colis. Relais Colis confirmed in mid-January 2026 that it had been compromised through one of its own subcontractors, exposing personal data on a large scale; the La Redoute delivery records now circulating appear to be a subset attributable to that upstream, third-party compromise.

The exposed data reportedly includes:

• Full names
• Complete postal addresses
• Phone numbers
• Email addresses
• Order and shipment numbers
• Delivery and return histories

No banking details, passwords or payment information were reported as part of the dataset. While each field is routine for a delivery operation, the combination is highly useful for targeted phishing, fake-parcel and courier scams, and identity fraud. At the time of reporting La Redoute had not issued a full public confirmation, and the status of any regulatory notification or remediation remains unclear.