Printemps
ModerateConfirmedRetail
Printemps notified some of its customers that an unauthorized third party accessed and extracted certain personal data between 31 July and 17 August 2026. The access resulted from a previously unknown Metabase vulnerability exploited at Shipup, the retailer's delivery-tracking provider. The exposed data covers the names, email addresses and phone numbers of customers who had requested parcel tracking. Printemps notified the French data protection authority (CNIL) on 25 August 2026.
The exposed contact details could be used for phishing, smishing or fraudulent calls impersonating Printemps or a carrier.
- Disclosed on
- August 25, 2026
- Sector
- Retail
- Country
- France
- Cause
- Third-party provider
Exposed data
- Email address
- Full name
- Phone number
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
- Printemps (Shipup)FrenchBreaches
- Printemps : les données clients dérobées après une cyberattaque chez ShipupCyberattaque.org
- Fuite de données chez PrintempsFuites Infos
- Fuite de données chez Shipup, suivi de colis pour e-commerçants, prestataire connecté à boutiques et transporteurs, ce qui change pour vousEurope Infos
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact