Moulin Roty: customer data exposed after a cyberattack

On 18 April 2026, Moulin Roty — a well-known French maker of toys and baby and children's goods — emailed its customers to warn them of a cyberattack affecting its online store (moulinroty-maboutique.com). The incident stemmed from a compromise of the shared Magento e-commerce platform on which the site runs, part of a wider wave of attacks against Magento merchants in which threat actors planted backdoors and skimmers across many shops at once — a domino effect impacting numerous retailers simultaneously.

Moulin Roty stated that it had no element confirming with certainty that personal data had been compromised, but that the risk could not be entirely ruled out. The data categories potentially at risk for affected accounts were:

• Identity details (first name, last name)
• Contact details (email address)
• Customer-account credentials (email/login)
• Purchase history
• Marketing preferences

The company stressed that banking and payment-card data were not affected. As a precaution it advised customers to change their passwords, watch for unusual account activity, and stay alert to phishing attempts, reminding them that it never asks for passwords or banking details by phone or messaging.

The number of affected customers was not disclosed. As of the company's 22 April update the investigation remained ongoing, and no confirmed data exfiltration had been published.