Carrefour warns of customer data breach via logistics partner

Carrefour has issued a warning to its online customers following a cyberattack on Shipup, an external logistics tracking provider. The breach involved the theft of personal contact information, including names, first names, email addresses, and telephone numbers.

Carrefour clarified that the incident did not directly affect its own internal IT systems and that customer passwords and banking details remain secure. The vulnerability originated from a software flaw, identified as CVE-2026-72898, within the Shipup infrastructure. The company has notified affected users to protect them against potential targeted phishing attempts.