Leak at Poltronesofa

On the evening of 27 October 2025, Poltronesofà — the well-known Italian sofa and upholstered-furniture retailer with a large presence across France and Europe — was hit by a ransomware attack. Intruders penetrated the group's servers, encrypted files and paralysed virtual machines, while also exfiltrating customer records before the encryption. The company publicly confirmed the incident in late November 2025 and began notifying affected individuals under Article 34 GDPR.

The attack exfiltrated personal data belonging to thousands of customers — including, in some cases, people who had merely registered years earlier without ever completing a purchase, raising questions about the retailer's data-retention practices. According to the company, no banking or payment-card data was involved.

Exposed data categories included:

• First and last names
• Postal addresses
• Email addresses
• Mobile phone numbers
• Tax identification numbers

Poltronesofà said it contained the incident rapidly: it isolated the affected systems, engaged external cybersecurity specialists, ran a technical investigation and deployed corrective and reinforced security measures. The company set up a dedicated contact address for affected individuals to report suspicious activity. Because the stolen identity and contact details are sufficient to fuel targeted phishing, phone scams and other social-engineering attempts, customers were warned to remain vigilant. No specific ransomware group or ransom demand was publicly confirmed, and no exact count of affected records was released.