Data leak at Magasins U - unspecified volume

On 21 April 2026, Magasins U — the French retail cooperative behind the Super U, Hyper U and U Express supermarket brands — began notifying loyalty-card holders by email that their customer accounts on the magasins-u.com portal had been compromised. The retailer disclosed the breach publicly around 22 April and reported it to the French data-protection authority (CNIL) within the GDPR's 72-hour window.

The intrusion targeted customers' online loyalty accounts. While the cooperative did not detail the exact mechanism, it said it detected suspicious activity on the portal and reinforced its protections — including enhanced anti-bot defenses — consistent with an automated attack against the customer login area rather than a deep compromise of internal systems.

The exposed data covered loyalty-account profile information:

• Title/salutation and customer status
• First and last name
• Email and postal address
• Phone number
• Loyalty card number

Magasins U stated that banking and payment data were not affected. As a precaution it urged customers to change their account passwords (via the "forgot password" feature) and their loyalty-card PIN codes, and warned that the leaked contact details could be reused in phishing and spear-phishing campaigns. The number of affected customers was not disclosed.