Cyber Incident Victim: E.Leclerc
Date:
Jan 2025
Location:
France
Summary
A French retailer suffered a cyberattack targeting its energy savings program, compromising sensitive customer data including names, email addresses, case numbers, financial reward amounts, and service descriptions. Access credentials such as passwords or their encrypted versions may also have been exposed. The breach occurred amid a surge in similar incidents affecting multiple national organizations. In response, the company secured impacted accounts, enforced password resets, and advised affected users to update similar credentials across other platforms. Regulatory authorities were notified, with potential investigations into security practices and planned heightened oversight to prevent future occurrences.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
E.Leclerc experienced a cyberattack targeting its Primes énergie program, which provides financial assistance to individuals for energy-saving home renovations. The attackers compromised sensitive customer data, including names, email addresses, case file numbers, subsidy amounts, and descriptions of services rendered. There was also potential exposure of login credentials, such as passwords or their encrypted versions. The breach occurred amid a broader surge of cyber incidents in France, with over thirty attacks documented between September and November 2024 affecting approximately 4.5 million data records across multiple organizations. E.Leclerc promptly notified the French Data Protection Authority (CNIL) about the incident, triggering a potential investigation into the company’s security protocols.
Affected customers faced heightened risks of credential-stuffing attacks, where hackers reuse stolen credentials to infiltrate other online accounts. In response, E.Leclerc implemented immediate containment measures: securing compromised accounts, enforcing mandatory password resets, and advising users to update similar credentials on other platforms. The CNIL announced plans to intensify security audits in 2025 to prevent similar breaches. The incident coincided with separate cyberattacks against French sports federations by a threat actor known as "TheFrenchGuy," though no direct link to the E.Leclerc breach was established. No evidence suggested customer data from E.Leclerc was auctioned on dark web markets, unlike datasets from other compromised entities. The attack underscored operational disruptions to the Primes énergie program and broader challenges in securing customer incentives against evolving threats.