The Emperador ransomware group says it has attacked Alain Afflelou, the French optical and hearing aid retailer, and is threatening to publish customer personal data. The group added Afflelou to its leak site on 26 October 2026. It posted a file called "afflelou_leak.txt", listed at 11.1 MB, and a screenshot showing one customer's full record. Afflelou has not commented publicly, no regulator filing has been published, and no one has independently checked the data. For now this is a claim by the attackers. It is not a confirmed breach. The listing comes nine days after a separate leak of old Afflelou invoice records by a different actor, and nothing so far ties the two together.
What Happened
Cyberattaque.org first reported the listing. It says the leak site timestamps the post at 20:14 on 26 October 2026. QPulse logged the listing at 21:52 UTC the same day. The threat monitoring firms ThreatMon and RansomLook also picked it up, and ThreatMon's feed dates it 27 October. These times differ only because each tracker saw the post at a different moment. None of them disputes when the post went up.
The Afflelou page includes a preview of the data and a countdown timer. When Cyberattaque.org looked, the timer had more than seven days left and the file was in a section for upcoming publications. That puts the threatened release in early November. Leak sites commonly use this setup to push victims into paying.
Being listed does not show that Afflelou's systems were encrypted or that its operations have been disrupted. Cyberattaque.org makes this point directly. No outlet has reported store or online outages. QPulse calls the theft of 11.1 MB "confirmed", but that only repeats what the group says. Cyberattaque.org, Cybactu, fuitededonnées.fr, mAlice.ai and Undercode News all describe it as unverified.
Afflelou was founded in 1972 and runs more than 1,500 stores in about 20 countries. QPulse reports network revenue of €1.13 billion for the financial year ending July 2025.
What Was Taken
The group's main evidence is the 11.1 MB text file. How many people it covers is unknown. Cybactu says the number of affected customers has not been established, and nobody has published a record count.
Cyberattaque.org and fuitededonnées.fr reviewed the preview. According to their accounts, each record links several kinds of information to one customer:
- First and last name, email address, phone number, date of birth and postal address
- Order history, payment and delivery details, and subscription information
- A subscriber number and a "salesforce_id" field
- A field that counts the payment cards linked to the account
Cybactu describes one sample customer who had spent €254 over three orders since 2021. That suggests at least some of the records are fairly recent. No outlet saw full card numbers or complete bank details in the screenshots, and Cybactu reports that no medical or prescription data was found. That matters for an optician: prescription and hearing test records would count as health data under GDPR, and so far there is no sign they are in the file.
The Salesforce ID points to an export from a customer relationship management (CRM) system. Fuitededonnées.fr cautions that this does not mean Salesforce itself was compromised. It is equally unclear whether the data came from Afflelou's current systems, a contractor, or an old database. Cybactu lists all three as open questions.
The 17 October leak is a separate incident. On 17 October, Cyberattaque.org reported that a hacker called Syrv4x had published, free of charge, about 28 MB of data containing 49,761 rows. It was attributed to afflelou.apprographic.com, an old business portal that stores used to order business cards, prescription holders and other printed items. The rows are invoices sent to franchised stores, not customer records, and the sample invoices are dated March 2015. Some outlets have run the two stories together. Cybactu says no technical link between them has been shown. The 49,761 figure belongs only to the old portal leak and should not be read as the size of Emperador's claim.
Why It Matters
Emperador has been posting victims at a fast rate. RansomLook recorded 13 organisations on the group's leak site between 18 and 27 October, according to mAlice.ai. They include AB InBev, Frommann Energie GmbH, Phoenix S&S GmbH and TRANSPORTES JIMENEZ, along with Afflelou. QPulse says the group has been actively targeting retail and e-commerce companies. RansomLook's records do not show whether any of these victims has confirmed an attack.
Afflelou is a franchise network, so customer data may be held in many places: central CRM, e-commerce, subscription services and store systems. The two incidents in October show the problem. Even if one turns out to involve old data, leaks from contractor portals and forgotten systems still damage the brand and give scammers material.
The data in the preview is ideal for targeted phishing. Cybactu's example is a text message that quotes a customer's last glasses order and the correct amount. With a name, date of birth, address and real order details, a fake delivery, refund or subscription renewal message becomes very convincing. If the file is published, Afflelou customers should expect messages like this.
The Attack Technique
How Emperador got in is not known. The group has not said how it obtained the data, and neither RansomLook nor QPulse has information on the entry point. There is no evidence of encryption.
The available details fit a data theft and extortion operation more than a disruptive ransomware attack: a single text file, structured CRM-style records and a countdown to release. A file of 11.1 MB is small for a full database dump. It could be a filtered export, a sample kept back to pressure the victim, or a complete copy of a smaller dataset. The Salesforce field suggests the data came from a CRM export or an integration that can read CRM records. Over the past two years, many intrusions have relied on stolen credentials for SaaS platforms, connected third-party apps or support accounts, rather than attacks on core servers. That is a reasonable line for investigators to follow. It is not an established finding in this case.
What Organizations Should Do
- Audit access to your CRM and SaaS systems. Check who and what can export customer records from Salesforce and similar platforms, including connected apps, API tokens, contractor accounts and integration users. Remove access that is not used and require phishing-resistant MFA for administrator and export permissions.
- Alert on large exports. Set up monitoring for bulk report downloads, API queries that return unusually large result sets, and data extraction outside business hours from CRM and e-commerce systems.
- Find and shut down old portals. Retired contractor sites like the print portal behind the 17 October leak often keep live data long after anyone remembers them. List every subdomain and contractor-hosted service using your brand and delete data that has no current purpose.
- Check franchise and contractor data flows. In franchise networks, customer data passes through many organisations. Map where it goes, put security requirements in contracts, and check that contractors can detect and report incidents quickly.
- Prepare customers before a leak. If your brand is listed on a leak site, warn customers early about texts and emails that quote real order details. Tell them how you actually contact them and that you will never ask for card details by text.
- Watch leak sites and start incident response early. Monitor ransomware leak sites for your brand and your key contractors. When a claim appears, check the sample against your own systems straight away, so that GDPR's 72 hour notification deadline does not run out while you are still finding out whether the data is real.
Sources: Afflelou visé par un ransomware qui menace de diffuser les données... | Afflelou : cyberattaque revendiquée par Emperador Cybactu | Emperador Ransomware Group Claims Data Exfiltration from Afflelou G... | Emperador claims attacks on 13 organizations, including TWICE SRL a... | Emperador Claims Afflelou as a New Victim as Ransomware Groups Targ... | Undercode Cyber Threat Intelligence: Ulose Claims zzq-test as Emper... | Afflelou : 49 761 factures d’un ancien portail interne en fuite apr... | Afflelou : un groupe de ransomware revendique le vol de données cli...