Short answer
LDLC emailed customers from 2 October 2026 to say a malicious actor gained access to one of its information systems and that some personal data could have been viewed. The retailer says passwords, bank details and card numbers were not affected, and it has told the CNIL.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | LDLC |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Online retail (computers and electronics) |
| Country | France |
| Disclosed | 2026-10-02 |
| People or records affected | Not disclosed by LDLC |
What data was exposed
- Last and first names
- Postal and email addresses
- Mobile, landline and fax numbers
- Title and language
- Internal customer code and customer type (individual or professional)
- Account creation date and last login date
What happened
Customers of the French computer and electronics retailer LDLC began receiving an email on Friday 2 October 2026. It said an “acteur malveillant” (malicious actor) had gained access to one of the company’s information systems. MacG covered it on 3 October, and Journal du Geek followed three days later.
Some customers got the message only over the weekend, so check your spam folder if you have an LDLC account.
What LDLC has said
The company says it isolated the affected system, reviewed access rules and notified France’s data protection authority, the CNIL, as the law requires. It describes the exposed information as identity and contact details plus account metadata. It says passwords, card numbers and bank details are safe.
LDLC has not said how many people are affected, when the intrusion happened, how the attacker got in, or who is behind it.
A repeat target
This is not the first alert. According to Journal du Geek, LDLC was hit in 2021 by Ragnar Locker, which offered 29.5 GB of internal data for sale. In February 2024, data on 1.5 million customers was stolen, and another leak followed in December 2024. The article also mentions a hacker reselling an older database of more than 1.5 million customers last May. If your details were in earlier leaks, scammers may already have them, and the new data can help them make messages look current.
How to read the risk
The exposed fields are enough for a convincing fake. A message that opens with your name, your address and your customer type feels legitimate. Read our guides on phishing messages and toll and delivery text scams to see the common patterns, and follow the steps in what to do after a data breach.
Tips for professional accounts
LDLC lists whether an account is private or professional. Business buyers should warn colleagues, since fake supplier invoices and “urgent transfer” emails often target firms that are known to buy IT equipment. See our guide on urgent payment scams.
What is still unknown
Whether the CNIL will investigate is unclear. For comparison, Journal du Geek notes the regulator fined Free and Free Mobile 42 million euros in January 2026 over a 2024 leak. See more incidents in our breaches section.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails and SMS that use your name and address and claim to be LDLC, a carrier or customer service.
- Fake parcel, refund or account-verification messages with a link to a lookalike site.
- Phone calls from fake bank advisers or fake LDLC support who quote your customer details.
What to do if you are affected
- 01Do not click links in messages about refunds, blocked parcels or account verification. Type ldlc.com into your browser yourself.
- 02Never give bank details or card numbers to anyone who contacts you by phone, email or SMS, even if they know your name and address.
- 03Change your LDLC password if you use it anywhere else, and use a password manager for unique passwords.
- 04Report phishing messages to Signal Spam and the national platform 33700 for SMS, and scam attempts to Cybermalveillance.gouv.fr.
- 05If you lost money, contact your bank and file a complaint with the police or on the Thesee online portal.
Frequently asked questions
Were my LDLC password and bank details stolen?
LDLC says passwords, login identifiers, card numbers and bank account details (RIB) were not affected. That is the company's statement and has not been independently verified.
How many LDLC customers are affected?
LDLC has not said. Its email also does not give the date of the intrusion or the method used.
Was the data actually stolen?
LDLC's wording is that the data was susceptible of having been accessed, so access is possible but theft is not confirmed in the sources we read.
Has anyone claimed the LDLC attack?
No group had publicly claimed it when Journal du Geek reported on 6 October 2026.
Has LDLC been breached before?
Yes. Both outlets describe this as its fourth incident since 2021, after earlier attacks including a 2024 leak affecting about 1.5 million customers.
Sources
- LDLC s'est encore fait pirater : voici ce que les hackers ont pu voir dans vos données personnelles (LDLC hacked again: what the hackers could see in your personal data), Journal du Geek, 2026-10-06
- LDLC victime d'un quatrième piratage : les données personnelles de ses clients exposées (LDLC suffers a fourth hack: customers' personal data exposed), MacG, 2026-10-03
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.