Leak at Picard

On 12 November 2024, Picard — the French frozen-food retailer — emailed roughly 45,000 members of its loyalty programme to warn them that their accounts had been accessed without authorisation. The company attributed the incident to a credential-stuffing attack: rather than breaching Picard's own databases, attackers reused usernames and passwords stolen in unrelated breaches to log into customer loyalty accounts where people had recycled the same credentials.

Picard said it found no intrusion into its central systems, indicating the compromise was limited to individual customer accounts rather than a backend database breach. Banking and payment data were not affected. The data exposed in the accessed accounts included:

• Last name, first name and date of birth
• Email address, postal address and phone number
• Loyalty card number, loyalty points, discount vouchers
• Order history, receipts, shopping lists and purchase preferences

The company reported the incident to France's data protection authority, the CNIL, reinforced its security systems and stepped up monitoring of suspicious login attempts on customer accounts. It advised affected customers to change their passwords immediately — especially anywhere they had reused them — and to be wary of phishing or other suspicious communications. The breach was one of a wave of attacks on French consumer brands in late 2024, following similar incidents at SFR and Free.