Boulanger boulanger.com Boulanger data breach: what happened and what to do
In September 2024 the French electronics retailer Boulanger was hit by a cyberattack. Have I Been Pwned counts 2,077,078 accounts: emails, names, phone numbers, physical addresses and coordinates. The data was later published online.
View all 13,115 breaches- Breach date
- 6 Sept 2024
- Affected
- 2,077,078
- Data exposed
- Email addresses, Geographic locations, Latitude and longitude pairs, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Boulanger is one of France's biggest electronics and appliance retailers. On 6 to 7 September 2024 it was hit by a cyberattack, and customer data later ended up published on a hacking forum. Have I Been Pwned (HIBP) dates the breach to 6 September 2024, added it on 8 April 2025 and counts 2,077,078 accounts.
What happened
Boulanger said on 8 September 2024 that the intrusion happened overnight and affected part of its customer information. At that point it said the data taken was delivery addresses and that no banking data was involved. It also said the incident had been contained, customers had been informed, and its website and app were working normally.
Later findings showed more than that. HIBP says the data exposed over 27 million rows, containing 2 million unique email addresses along with names, physical addresses, phone numbers and latitude and longitude. Reports describe a large file attributed to the attacker and a second smaller one, and different researchers counted different numbers of unique customers. HIBP's figure is 2,077,078 accounts.
Boulanger wasn't alone: other French retailers announced attacks in the same week, and reporting suggested some may have shared a supplier. That link is unconfirmed.
What was exposed
HIBP lists email addresses, geographic locations, latitude and longitude pairs, names, phone numbers and physical addresses. No passwords or payment card data are listed.
The latitude and longitude pairs are the notable detail. They're coordinates tied to an address, so the record places a person at a precise spot, not just on a street.
What that lets criminals do
Delivery-focused data suits delivery scams. A text saying "your Boulanger parcel can't be delivered, confirm your address" matches a real purchase and a real address, which makes the fake page convincing. The same goes for fake refund and after-sales messages.
The combination of name, address, phone number and email makes identity-based fraud easier: someone can use these to pass a weak verification check or to impersonate you to a carrier or a delivery company.
Because the dataset was published, not just stolen, it can be copied again and again. It is worth assuming the data stays in circulation.
The company's response
Boulanger's early statement said that only delivery addresses were involved and that no bank details were taken. HIBP's description of the data is broader than that statement. The sources below set out both accounts.
How to check
Search your email address on HIBP. If you shopped at Boulanger, check the address you used for orders and any you used for loyalty accounts.
Where to start
Begin with delivery and refund messages. Until you've checked them in your own account, treat any text or email about a Boulanger order as unverified. After that, review how much of your address and location is stored with retailers you no longer use.
What to do if you were in it
- 1
Expect phishing that uses your details
Emails, texts and calls that mention your name, employer or phone number are more believable. Don't click links in unexpected messages. Go to the company's site yourself, and treat urgent requests for money or codes as a red flag.
- 2
Check delivery and refund messages before you click
If a message about a Boulanger order asks you to confirm details or pay a fee, don't use its link. Open the retailer's site or app yourself and look at your orders.
- 3
Keep an eye on your accounts
No passwords or cards are listed, but watch your email, bank and phone accounts for changes you didn't make. Ask your carrier about extra account protection.
- 4
Be careful who gets your address and coordinates
Exact location data is hard to take back. If anyone you don't know contacts you about where you live, don't confirm anything and keep a record of the message.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It checks breach databases for your email address and phone number and shows which breaches include you, so you know which passwords and accounts to deal with first.
Frequently asked
Was I affected by the Boulanger breach?
Search your email address on Have I Been Pwned. It lists 2,077,078 accounts for Boulanger.
What was exposed?
Email addresses, names, phone numbers, physical addresses and latitude and longitude pairs. HIBP lists no passwords or card data.
Did Boulanger confirm the attack?
Yes. It said in September 2024 that it had been hit by a cyberattack that affected part of its customer information.
Should I change my password?
No passwords are listed. Change one if you reuse it, and watch for phishing.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
