Cybersafetyconnections December 2, 2024, vol#197 

  • Some customers had some of their data leaked. 
  • The cyberattack was targeted at the customer loyalty program. 
  • No cybercriminal has claimed responsibility for the data breach. 
  • Here are steps that Auchan took to mitigate loss from cyberattack. 

What happened? 

Usine-digitale.fr 

According to Usine-digitale.fr Auchan reported unauthorized access to its systems, exposing personal data such as customer addresses, phone numbers, and dates of birth. 

 Fortunately, bank details and identification information remain secure.  

Who was Impacted? 

Program Carrefour Auc 

On November 19th, 2024, Auchan disclosed that a cyberattack led to unauthorized access to personal data linked to customer loyalty accounts.  

The compromised information includes names, email and postal addresses, phone numbers, loyalty card numbers, and account balances.  

Family composition details may also have been shared, depending on customer input. Affected customers are in the “hundreds of thousands.” 

Why did it happen? 

Data Security Breach 

Although I started seeing a lot of cyberattack news from France after the Paris Olympics, apparently, there have been previous data breaches at Auchan before now, so this could not be because of the Paris Olympics!  

No reason was given for this data breach except the theft of data! 

Which criminal group took responsibility for the data breach? 

Hacker Stock Art -Boing Boing 

No cybercriminal group claimed responsibility for the attack. 

How did Auchan mitigate loss from the data breach? 

OWASP Threat and Safeguard Matrix 

  • The retailer stated it has implemented all necessary measures to end the cyberattack and enhance the protection of its information systems.  
  • These measures include stronger controls to identify any suspicious activity involving loyalty cards. 
  •  The cybersecurity incident has been reported to the CNIL (French data protection authority). 

And as it is customary for YCSA (Your Cyber Safety Advocate), Copilot was consulted with this prompt. 

“How could Auchan have mitigated loss from the data breach”? 

And here we go with advice from Copilot. 

Auchan could have taken several steps to mitigate the loss from the data breach: 

  • Immediate Response  

Upon discovering the breach, Auchan acted swiftly to contain the attack and implement additional security measures. This quick response helped limit the extent of the damage. 

  • Customer Communication 

Auchan informed affected customers about the breach and provided guidance on how to protect themselves from potential fraud. This transparency helps maintain customer trust and allows individuals to take proactive steps to secure their information. 

  • Enhanced Security Measures 

Implementing stronger security protocols, such as multi-factor authentication (MFA), regular security audits, and encryption of sensitive data, can help prevent future breaches. 

  • Employee Training  

Educating employees about cybersecurity best practices, such as recognizing phishing attempts and using strong, unique passwords, can reduce the risk of future breaches. 

  • Monitoring and Detection 

Continuous monitoring of systems for suspicious activity and having a robust incident response plan in place can help detect and respond to breaches more effectively. 

  • Data Minimization 

Limiting the amount of sensitive data collected and stored can reduce the impact of a breach. For example, Auchan could review its data retention policies to ensure that only necessary information is kept. 

Conclusion 

By implementing these strategies, Auchan could have better protected its customers’ data and mitigated the impact of the breach. 

Subscribe to get the latest blog post.