Massive hack at Cultura: personal data of 1.5 million customers stolen by hackers

After the household appliance brand Boulanger, it is now Cultura's turn to announce to its customers the theft of 1.5 million data.

The personal information of 1.5 million Cultura customers, including name, first name, email address, postal address, date of birth, telephone number and details of products purchased, have been stolen, the brand revealed on Tuesday, September 10, 2024, indicates Ouest France.

This data was stolen as part of an order via an external IT service provider, which was "victim of a malicious intrusion into its database" during an attack affecting several companies.

In an email sent to its customers, Cultura states that "our investigations indicate that the personal data of some of our customers has been affected". The household appliance seller Boulanger suffered a similar attack, with more than 27 million data siphoned, according to ethical hacker Clément Domingo. This information was put on sale for 2,000 euros.

Other brands concerned

According to the specialist website Zataz, “the hacker also claimed responsibility for stealing data from other brands”, including 684,966 customer data from GrosBill (computer retailer), 2.6 million data from Cultura, 248,501 customers from DIVIA Mobilité (transport in Dijon), 2.7 million customers from PepeJeans (clothing), and 375,760 data items listed under the heading “Assurance Retraite”.

“The elements of The evidence provided by the young hacker is partial. While Boulanger and Cultura have confirmed the theft of data, concerning what he called ‘Assurance Retraite’, we do not know what it is", warns Damien Bancal, cybersecurity specialist and author of the Zataz website.

Cultura tries to reassure by specifying that "data relating to passwords and banking data is not compromised". The exact origin of the leak is still under investigation and could come from a host or of a common service provider for several companies.

Anssi, the national cybersecurity agency, declined to comment, but confirmed that “interdependencies between IT players are a reality”.