Celinni
CriticalConfirmedRetail
On September 26, 2026, a cybercriminal group claimed to have breached the website of Celinni, a Paris-based jeweler specializing in certified diamonds and jewelry. The claim concerns roughly 12,000 customers, with names, email addresses, phone numbers, postal addresses, customer accounts, order histories, invoices and identity documents; supplier business data was reportedly also taken. Celinni confirmed an intrusion by disabling a compromised login and migrating its transactional emails, three days after a phishing message impersonating the French health insurance agency was sent from a @celinni.com address.
Combining an identity, postal address and high-value jewelry purchase history makes it possible to identify households owning valuable gems, while the exposed identity documents could facilitate identity theft.
- Disclosed on
- September 26, 2026
- Incident dated
- September 23, 2026
- Accounts affected
- 12,000
- Sector
- Retail
- Country
- France
- Cause
- Credential stuffing
Exposed data
- Full name
- Email address
- Phone number
- Postal address
- Customer ID
- Order history
- Identity document
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact