Groupement Les Mousquetaires, the retailer co-operative behind French supermarket chain Intermarché, confirmed on Monday 3 August 2026 that an intruder gained unauthorised access to customer records belonging to Drive Intermarché, its click-and-collect grocery service. The group told AFP that 287,605 Drive customers have been identified as affected and notified so far, out of a Drive base of roughly two million, with investigations continuing and the final figure expected to grow. Coverage across French and international outlets has rounded the impact to "nearly 300,000." Names, phone numbers, postal addresses, dates of birth, loyalty card numbers and some order metadata were taken. The company says no banking data, passwords, email addresses or loyalty point balances were involved. The incident was reported to the CNIL and a criminal complaint was filed with the Paris prosecutor's office.
A sourcing note up front: every account currently available is press reporting, most of it derived from the same AFP statement or from direct comment given to individual outlets. There is no published regulator filing, CERT advisory or standalone company incident page in the material reviewed here. Treat the technical picture as provisional.
What Happened
The attack occurred during the week of roughly 27 July 2026, described by the group only as "last week" relative to its 3 August confirmation. The French Compliance Institute places it in the last week of July. Disclosure was not self-initiated: the breach was first surfaced by the specialist site French Breaches, and Intermarché confirmed it afterwards to French media. BFMTV, Ouest-France, actu.fr and Le Monde Informatique all attribute the confirmation to the same AFP statement, which is why their wording is near-identical.
Le Parisien obtained additional comment directly from the group. A spokesperson told the paper that "our teams detected internally and blocked the attack that targeted the files of our Drive service customers," that unauthorised access has been interrupted, and that no new suspicious activity has been observed to date. Le Parisien also reports the internal investigation is still running against a customer database of two million records, and notes Intermarché operates 1,969 Drive pickup points.
The group says it moved to contain the incident, hardened its systems, and is co-operating with the relevant authorities, including meeting its GDPR breach notification obligations to the CNIL. It filed a complaint with the Paris parquet, which puts the matter in the hands of French cybercrime prosecutors.
One number deserves care. The affected-customer count is consistently 287,605 across Le Monde Informatique, BFMTV, Ouest-France, actu.fr, RetailDetail and Le Parisien, all citing the retailer. The Connexion rounds it to "around 287,000 people being informed so far." The headline "300,000" figure that appears everywhere is journalistic rounding of that same number, not a separate count. Separately, Le Parisien's URL slug reads "2 millions de clients concernés," which reflects the total size of the exposed database rather than the confirmed victim count; the article body itself states nearly 300,000. Anyone citing this incident should use 287,605 confirmed and notified, against a two million record population still under investigation.
What Was Taken
The exposed fields, per the company statement relayed by AFP and reproduced across BFMTV, Ouest-France, actu.fr, RetailDetail and Le Monde Informatique:
- First name and surname
- Telephone number
- Postal address, described by Le Parisien specifically as the billing address
- Date of birth
- Loyalty card number
- Certain information relating to online orders
Le Parisien adds the most granular detail on that last category: attackers accessed the order number, the order amount and the billing address, but "the detail of products ordered is not concerned." No other source contradicts this, though no other source corroborates it either.
Explicitly excluded, per the retailer: no banking data, no loyalty point balance amounts, no passwords, no email addresses.
That exclusion list is worth reading twice. The retailer says email addresses were not compromised, yet Le Monde Informatique and Le Parisien both report that affected customers were notified by email. Both statements can be true if the notification addresses come from a separate account system that the attacker did not reach, but the sources do not explain the distinction and no outlet appears to have pressed on it. It is the single loosest thread in the public account.
Sensitivity assessment: this is a high-quality identity dossier without a direct financial payload. Name plus verified phone number plus home address plus date of birth plus a loyalty identifier plus a real order history is close to the ideal input for voice and SMS social engineering. Date of birth in particular is a common knowledge-based authentication factor and is not rotatable. Loyalty card numbers give an attacker a plausible account reference to recite. The absence of card data lowers the immediate fraud ceiling; it does not lower the phishing risk, and Intermarché's own customer email says as much.
Why It Matters
This is the loyalty and fulfilment tier of retail being treated as a target in its own right. Drive platforms sit slightly outside the core payment estate, which is exactly what makes them attractive: they aggregate identity-grade personal data at scale, they are frequently built and operated with less scrutiny than payment systems, and they are not covered by the same PCI-driven controls that harden the card path. The attacker here appears to have gone after customer files rather than transactions, which is a rational choice when the file itself is the product.
For French organisations specifically, this lands in an ongoing sequence. Le Monde Informatique and The Connexion both frame it as the latest in a run of breaches against major French firms, with The Connexion pointing back to the comparable Auchan incident in 2024 and Le Parisien noting the retailer joins a grim list of French chains hit over the past two years. Le Parisien also links the pattern to young domestic hackers monetising bulk personal data. Whatever the specific actor here, the operating assumption for French consumer-facing brands should be that customer databases are being actively hunted, and that disclosure will often be forced by an external researcher or leak-tracking site before internal comms are ready.
Two secondary lessons for defenders. First, detection appears to have worked: the group says its own teams found and blocked the intrusion, which is better than the norm for this class of incident. Second, it did not prevent bulk exfiltration, which is the gap most retail security programmes actually have. Blocking after the pull is a partial win.
The Attack Technique
No source identifies an initial access vector, a vulnerability, a threat actor or a ransomware or extortion brand. None reports a ransom demand, encryption, or a leak site posting. Nothing in the reviewed material names credential stuffing, an API abuse case, a third-party or supplier compromise, or an exploited public-facing application.
What is publicly stated is narrow and comes almost entirely from the Le Parisien spokesperson comment: the attack targeted Drive customer files, it was detected internally rather than by an outside party, it was blocked, unauthorised access was interrupted, and no further suspicious activity has been seen since. The rest of the reporting uses the deliberately neutral formulation "unauthorised access to certain customer data," which is the language of an organisation that either does not yet know or is not yet saying.
Reading between those lines, the shape of the incident is consistent with bulk retrieval from a customer database rather than a destructive intrusion, and the scoping uncertainty across a two million record base suggests the investigation is still reconstructing exactly which records were touched. That is an inference, not a finding. Any attribution circulating for this incident should be treated as unsupported until Intermarché, the CNIL or French law enforcement says otherwise.
What Organizations Should Do
- Inventory your click-and-collect, loyalty and fulfilment databases as crown jewels. These systems aggregate name, address, DOB and phone at the same scale as your core CRM but often sit under different ownership and a lighter control baseline. Bring them under the same access review, logging and encryption-at-rest standards as the payment path.
- Instrument for bulk read, not just for intrusion. Detection worked here; prevention of exfiltration did not. Alert on anomalous query volume, unusual result-set sizes, off-hours bulk exports and any single credential or API token pulling records at a rate no legitimate workflow requires. Rate-limit and cap result sets on customer lookup endpoints by default.
- Audit every path into the customer database, including service accounts and partners. With no confirmed vector, assume the common ones: exposed or over-permissioned API endpoints, stale integration credentials, a compromised employee or supplier account, and internet-facing admin interfaces. Rotate long-lived tokens and enforce phishing-resistant MFA on all administrative and integration access.
- Pre-build the post-breach phishing defence. Data of this shape feeds convincing vishing and smishing within days. Publish a standing statement of what your company will never ask for by phone or SMS, ensure customer-facing staff can verify inbound contacts, monitor for lookalike domains impersonating your brand, and consider proactively degrading knowledge-based verification that relies on date of birth or loyalty number.
- Rehearse the forced-disclosure scenario. This breach became public via an external site before the retailer spoke. Have holding statements, regulator notification packets and customer email templates ready to deploy inside 24 hours, and make sure the notification channel you plan to use does not depend on data that might itself be in scope.
- Treat scoping as an ongoing obligation. Intermarché has notified 287,605 people and openly says more may follow. Build your own process to re-notify as forensic scope expands, rather than treating the first notification round as final. Under GDPR, the CNIL will expect the update.
Sources: Intermarché cyberattack 2026: Nearly 300,000 customers' data stolen... | Intermarché victime d'une fuite de données après une cyberattaque -... | Des noms, des adresses mais pas d'informations bancaires: les donné... | Intermarché falls victim to cyberattack: 300,000 customers affected... | Intermarché Data Breach: 300,000 Customers Hit by Cyberattack | Près de 300 000 clients concernés par une fuite de données après un... | Intermarché victime d'une cyberattaque : ce que l'on sait de cette... | Fuite de données : Intermarché Drive touché par une cyberattaque, 2...