Bureau Vallée: customer data was also held by the service provider

The retailer's email, forwarded to GDN by one of its recipients, is the main source for this article. It describes two incidents. The first allowed a limited number of customer records to be extracted from the management software. The second gave access to the databases, and also to the files hosted by the provider.

Neither online account passwords nor payment card data were affected, according to Bureau Vallée.

What we already knew since August

The story is not new. A few days before August 18, 2026, an actor calling itself ZeroBytes claimed a leak attributed to the retailer, covering nearly 56,000 records.

On August 18, Bureau Vallée's chief executive, Adrien Peyroles, spoke on BFM Business. He mentioned around 22,000 customers affected (surnames, first names, email addresses, phone numbers) and an access cut off after a few minutes.

The two figures do not measure the same thing. A record is not a person, and one person can account for several records, as an analysis published by Ostraca in August 2026 points out.

Nothing shows that the August incident is exactly the first of the two described in the email. Nor is there anything establishing a common attacker.

Files live next to the database, with their own rules

The second incident did not only involve databases. The provider also hosted the files produced by the point-of-sale and management software: exports, receipts, loyalty documents, exchanges between applications.

One file is used to match two customer records created in two different stores. Another applies a loyalty operation. A third records what happened at the till. That is how a retail business ordinarily works.

These files can contain the same information as a well-protected database, without necessarily being subject to the same access or retention rules. The email does not tell us whether that was the case here. The measures announced, however, show that the question is now being examined: tighter access rights, shorter retention periods, automatic deletion of files after processing, reinforced monitoring.

None of these measures prevents an intrusion. They limit what it can take away.

Ordinary data is enough to make fraud credible

A name, a company, contact details, sometimes purchases or loyalty benefits: a fraudster needs nothing more to write this. “Hello, we have identified an anomaly on your last in-store purchase. A refund is due. Please confirm your details using this link.”

At a business customer, that message lands with purchasing or accounting, and it mentions a credit note or an adjustment that sounds entirely plausible. Cybermalveillance.gouv.fr, the French government's victim assistance platform, saw requests for help from individuals linked to data breaches rise by 107% in 2025, after 82% in 2024. We described what follows a breach in a data breach can cost you your customers and your sleep.

What was kept separate stayed out of reach

Bureau Vallée states that the compromised point-of-sale and management systems were separate from the environments of its online store. Online logins, passwords and order histories should therefore not be affected. Payment card information, entrusted to specialized payment providers, was not in the systems that were hit.

That separation limited the exposed perimeter. It is one of the oldest principles in IT security: a compromised system should not automatically open up all the others. It requires separate environments, strictly necessary rights and as little circulation of sensitive information as possible.

A service contract is also a security document

Point of sale, ERP, CRM, accounting, e-commerce: data moves between applications run by several parties. You can have secured your own infrastructure perfectly and still be exposed through an external service you send data to every night. We discussed this, based on figures from the Cesin, in your AI automations work, but what can they reach.

In April 2025, the CNIL, France's data protection authority, published a teaching case on a data compromise at a processor, fictional but inspired by a real one. An employee of a logistics platform enters their credentials on a fake login page. The attacker reaches the databases of several client companies and downloads millions of rows. With no logs being analyzed, nobody notices.

Applied to the Bureau Vallée case, four points deserve to be written into the contract:

• Rights: one named account per user, and bulk downloads reserved for the roles that need them.
• Traces: access and actions logged, and logs that are actually analyzed.
• Remote access: limited, protected by VPN and multi-factor authentication.
• Retention: a defined period for each type of data, intermediate files included.

For the rest, the CNIL case and the ANSSI guide on outsourcing detail the measures and provide model clauses.

The contract must also organize the alert. The GDPR distinguishes the controller (here, the retailer) from the processor (the provider). The processor must notify its controller client without undue delay, and the CNIL recommends writing that obligation into the contract. When a breach poses a risk to people's rights and freedoms, the controller must then notify the CNIL without undue delay and, where feasible, within 72 hours of becoming aware of it.

What we still don't know

The total number of customers affected by the second incident has not been disclosed, nor have the exact dates of the two intrusions. The provider's identity, the technical entry point and any link between the two attacks are not documented. So these incidents cannot be traced to a vulnerability, a stolen password or a faulty configuration.

The retailer says the compromised access has been blocked, that measures have been taken or are being rolled out, and that investigations are continuing.

Three questions to ask your provider

They do not replace an audit. They are, however, enough to open the discussion at your next review meeting. The questions for your own teams (logs, crisis unit, spokesperson) are in cyberattack, the questions to ask your teams before the crisis.

1. Where does our data live on your side?

Not just the production database. Exports, exchange files between applications, test environments, backups, and the subcontractors you use yourself.

2. How long do your intermediate files survive?

An export that is useful for ten minutes has no reason to stay readable for six months. Automatic deletion after processing is part of how an application normally works, within legal retention obligations.

3. What happens if you are compromised tomorrow?

Who warns us, how quickly, and in how much detail? Which access can be cut off, and can we do it from our side? Who decides to inform our customers?

If your provider struggles to answer one of these questions, at least you know where to start the conversation.

Author · M.Baudoux - Software development & AI consulting