Leak at Leroy Merlin

On 3 December 2025, Leroy Merlin — the French home-improvement and gardening retail giant — disclosed that it had been the victim of a cyberattack exposing the personal data tied to its customer loyalty accounts. According to the company, several hundred thousand French customers were affected. The breach was limited to Leroy Merlin's French customer base and only concerned holders of a loyalty account.

The attack vector was not publicly detailed. Leroy Merlin stated that as soon as the incident was detected it took the necessary measures to block the unauthorised access and contain the breach, and that it continued to monitor its systems for any sign of misuse. France's data protection authority, the CNIL, was notified, and affected customers were emailed and warned to be vigilant against phishing attempts.

Exposed data categories included:

• First and last name
• Phone number
• Email address
• Postal address
• Date of birth
• Loyalty program information

The company emphasised that no banking information and no online account passwords were compromised, as those remained secured. At the time of disclosure no ransomware group had claimed responsibility, and Leroy Merlin reported no evidence that the stolen data had yet been leaked online or otherwise misused.