Data leak at Système U

On 24 April 2026, Système U — the French retail cooperative behind the Super U, Hyper U, U Express and Utile supermarket brands — began notifying customers that its magasins-u.com loyalty portal had been hit by a malicious cyberattack. The cooperative detected suspicious activity and confirmed that an external attacker had obtained unauthorized access to a number of customer loyalty accounts.

The intrusion targeted the online loyalty space rather than payment systems. Reporting points to automated, large-scale attempts to log into accounts (consistent with credential-stuffing-style abuse), after which Système U reinforced its anti-bot protections and added technical barriers to block fraudulent reconnection attempts. No attack method was officially named by the company.

Exposed personal data reportedly included:

• First and last name, plus civility and professional/customer status
• Email address and postal address
• Phone number
• Loyalty (Carte U) card number

Système U stated that no banking data was compromised — no card numbers, IBANs or payment information were affected. The cooperative notified France's data-protection regulator, the CNIL, within the GDPR 72-hour window, and urged customers to change their magasins-u.com password and to reset their four-digit Carte U PIN in-store with ID. The main residual risk is targeted phishing using the leaked contact details.