Intermarché Drive: The Security Breach Explained, and What an SME Needs to Check

In summary. Intermarché’s Drive service suffered a data breach affecting 287,605 customers, including names, contact information, and order details, but no passwords or banking information. The real risk for an SME is not direct: it lies in the highly targeted phishing campaigns that this data makes seem credible.

What Happened

On August 3, 2026, the Les Mousquetaires group, the parent company of Intermarché, confirmed a cyberattack that occurred in late July targeting customer files on its Drive service, the online ordering and in-store pickup platform. The retailer estimates that 287,605 customers were affected, out of a total of approximately two million accounts.

The exposed data includes first and last names, phone numbers, mailing addresses, dates of birth, loyalty card numbers, and certain order details such as order numbers and amounts. Intermarché notes, however, that passwords, email addresses, banking information, and loyalty points balances were not compromised. The retailer has notified affected customers via email and warned of an increased risk of phishing attempts. These details were reported by Usine Digitale, Le Monde Informatique, and Génération-NT.

Does this apply to me?

An SME may not be a customer of Intermarché Drive, but its employees often are in their personal capacity. That’s where the risk lies. With a real name, phone number, address, and order history, a scammer can craft a very convincing text message or phone call—pretending to be customer service, asking for package confirmation, or citing a payment dispute. An employee who has been trusted with personal information is also more likely to let their guard down at work.

The risk is rising for executives and accounting departments. Accurate personal data is used to lend credibility to identity theft, set up wire transfer fraud, or initiate contact ahead of an urgent request. If your company reuses the same numbers or addresses for business accounts, the risk extends to your business operations.

What to Do Now

Three reflexes, from the most immediate to the most fundamental.

1. Notify your teams today. A short message will suffice: a phishing campaign claiming to be from Intermarché is likely; do not click on any links received via text message or email; use the app or the official website to verify anything.

2. Be extra vigilant with sensitive requests. Any change to bank account information, any unusual transfer, or any urgent request should be verified through a second known channel (such as a call back to a trusted number). Remind the finance and procurement departments of this rule.

3. Review your own customer databases. If you handle personal data, assess your encryption, access segregation, multi-factor authentication, and logging practices. These are also the minimum requirements set forth by the NIS2 Directive for affected companies.

‍

‍

In a nutshell

The Intermarché data breach isn’t targeting your company, but it fuels more targeted scams aimed at your employees and executives. A reminder to stay vigilant and a clear policy on sensitive requests cover most of the risk. With the right procedures in place, this type of incident remains manageable.

Frequently asked questions

Have our business data been leaked? No, the leak involves personal accounts on Drive Intermarché. The risk to the company is indirect, through phishing attacks targeting your employees.

Should we change our passwords? According to the company, no passwords have been compromised. Nevertheless, be on the lookout for messages asking you to enter a password via a link you’ve received.

— Samir Amara, CEO — IT Systèmes