Intermarché Breach Hits 300K Shoppers: A Notification Checklist

On this page 8 sections

1. What Happened in the Intermarché Data Breach and What We Know so Far
2. Why a European Grocery Breach Matters to U.S. Merchants
3. The First 72 Hours: Contain, Preserve Evidence, Call Your Processor
4. Data Breach Notification Requirements for Merchants: State Laws, Card Brands and Customers
5. Personal Data vs. Card Data: How PCI Obligations Change the Response
6. Writing a Customer Notice That Limits Phishing Follow-Ups
7. Lower Your Exposure Now: Data Minimization and Vendor Access Reviews
8. Next Steps

Key takeaways

• The Intermarché breach exposed names, phone numbers, addresses, birth dates and loyalty numbers for 287,605 online grocery customers. The company says no bank details were taken.
• In the first 72 hours, contain the incident, preserve evidence, call your processor if card data may be involved, and bring in legal counsel early.
• U.S. notice duties usually depend on where affected customers live and what data was exposed. Deadlines and attorney general thresholds differ from state to state.
• A good customer notice says exactly how you will and won't contact people, so scammers can't use the breach as cover.

The Intermarché data breach exposed the personal details of nearly 300,000 online grocery shoppers in France. It's a good reminder that a breach doesn't need stolen card numbers to cause real trouble. This article covers what is known about the incident as of October 21, 2026, and why it matters to U.S. merchants. It also gives you a practical 72-hour checklist for containing an incident, figuring out who you must notify, and writing a customer notice that doesn't open the door to phishing.

What Happened in the Intermarché Data Breach and What We Know so Far

According to franceinfo, the attack happened during the last week of July 2026. It targeted customer files tied to Intermarché's Drive service, the chain's online ordering and pickup platform. Groupement Mousquetaires, Intermarché's parent company, confirmed the incident on August 3, 2026.

Here is what the company has said, as reported by RetailDetail and ESM Magazine:

• Exposed: last name, first name, phone number, mailing address, date of birth, loyalty card number, and some details about online orders.
• Not exposed (per the company): bank details, loyalty balances, passwords and email addresses.
• Scale: 287,605 Drive customers were identified as affected, out of roughly 2 million Drive users, and were notified.
• Regulators: Intermarché reported the incident to CNIL, France's data protection authority, and filed a complaint with the Paris prosecutor.

The story was back in the news this month. A Futura-Sciences report dated October 21, 2026 says the number of affected customers could still rise as investigations continue. In a separate incident, franceinfo reported that Intermarché stores were among several French grocery chains hit on October 12, 2026, by an attack on their refrigeration systems. Keep the two separate: one exposed customer data, and the other disrupted store equipment.

Why a European Grocery Breach Matters to U.S. Merchants

French privacy law doesn't apply to your shop. The way this breach played out does.

The data looks ordinary, but fraudsters find it very useful. Names, phone numbers, addresses, birth dates and order history are exactly what a scammer needs to pass as your store. L'Usine Digitale pointed out that this kind of data is prime material for phishing and social engineering. A text saying "Your pickup order #4417 needs a card update" is far more believable when it includes the customer's real name and recent items.

Grocers and retailers hold more data than they think. Online ordering, curbside pickup, delivery addresses, loyalty programs, age checks and e-receipts all add to your customer database. A grocery store with online orders, a Shopify store or a retail shop with a points program probably keeps much of the same data Intermarché lost. Our piece on the More Rewards breach and loyalty program weak spots covers that risk in more detail.

Notification is where small merchants slip up. Big chains have legal teams on call. A store with three locations usually doesn't, and the first few days shape how the rest of the response goes.

The First 72 Hours: Contain, Preserve Evidence, Call Your Processor

This checklist draws on the FTC's Data Breach Response: A Guide for Business, adapted for a small retail or grocery business. It's general information, not legal advice.

Hours 0–24: Contain Without Destroying Evidence

1. Name one person to lead the response. Pick the owner or a trusted manager. Keep a written, timestamped log of every action.
2. Take affected systems offline, but leave them powered on. A summary of the FTC guide explains why: forensic investigators need the equipment running to work out what happened. Disconnect from the network instead of wiping or rebooting.
3. Change credentials. Reset passwords for your POS back office, e-commerce admin, email, loyalty platform and any shared logins. Start with admin accounts.
4. Secure physical areas. The FTC recommends locking affected areas and changing access codes. In a store, that might mean the back office, the server closet or the charging station a tablet was stolen from.
5. Don't delete anything. Keep logs, suspicious emails and screenshots. If you wipe a compromised machine before it's examined, you may never learn what was taken.

Hours 24–48: Bring in the Right People

• Your payment processor, if card data, terminals, your gateway or your POS could be involved. Card brand rules generally expect merchants to report a suspected card data compromise to their acquirer quickly, and the processor coordinates the next steps. Check your merchant agreement for the exact reporting terms.
• Legal counsel with privacy experience. The FTC suggests talking to counsel early because federal and state laws may apply.
• Your cyber insurance carrier, if you have a policy. Many policies have their own notice requirements and preferred vendors, so read yours.
• A forensic investigator, if counsel, your insurer or your processor recommends one.
• Law enforcement. The FTC guide advises checking with investigators and law enforcement on when it's reasonable to resume normal operations.

Hours 48–72: Scope the Data and Plan Notices

• List the types of data involved: names, addresses, birth dates, card data, login credentials, government ID numbers.
• Work out which states affected customers live in. That decides which notice laws apply.
• Draft your customer notice and a staff FAQ. Don't send anything until counsel has reviewed the facts.
• Plan how you'll keep selling if systems stay offline. Our guide on keeping sales running when systems go dark covers backup payment options.

Data Breach Notification Requirements for Merchants: State Laws, Card Brands and Customers

State Breach Notification Laws

According to the NCSL, all 50 states, plus D.C., Guam, Puerto Rico and the U.S. Virgin Islands, have laws requiring private businesses to notify people of security breaches involving personal information. Retailers have no single federal standard, so you may have to satisfy several state laws at once.

These factors usually decide your obligations:

• Where customers live, not where your store is. A 2026 state-by-state summary from Coggno says deadlines depend on the states where affected individuals live. That matters for e-commerce sellers who ship nationwide.
• What data was exposed. Many statutes define "personal information" as a name combined with something more sensitive. L Squared Insurance Agency's 50-state guide says Alabama covers a name plus a Social Security number, driver's license number or financial account information, and that Delaware and Alaska also cover login credentials. An Intermarché-style data set (name, phone, address, birth date) may or may not trigger notice, depending on the state. Let counsel make that call instead of guessing.
• Deadlines. The Coggno summary lists California (as of January 1, 2026), Colorado and Florida at 30 calendar days for individual notice, and Texas at 60 days. New York also has a 30-day rule now. Per Morrison Foerster, amendments effective December 21, 2024, require businesses to notify affected New York residents within 30 days of discovering a breach. Massachusetts, according to Coggno, still uses an "as soon as practicable and without unreasonable delay" standard.
• Regulator notice. Many states also require notice to the attorney general once a certain number of residents are affected. CyberRiskPolicy reports that a 2026 California change requires attorney general notice within 15 days of individual notice when more than 500 residents are affected.

Secondary summaries don't always agree, and statutes change. Confirm current requirements with a qualified attorney before you rely on any deadline.

Your Processor and the Card Brands

If card data might be involved, your processor is your main channel to the card networks. Don't contact Visa or Mastercard yourself unless your processor tells you to. Expect questions about your POS, gateway, terminals and any third-party software that touches card data.

Customers

You must notify customers in the way the law requires. The notice is also your best chance to keep them from falling for follow-up scams, which the section below covers.

Personal Data vs. Card Data: How PCI Obligations Change the Response

The response path depends on what was exposed:

Card data brings in PCI DSS, the card industry's data security standard, along with your processor's contract terms. A breach involving only personal data, like Intermarché's, skips the card network process but can still trigger state law. The phishing risk is the same either way.

The less card data your systems touch, the simpler this table gets. EMV chip terminals, tokenization and 3D Secure authentication for online payments all reduce how much sensitive card data your business handles. For background, see EMV chip cards and the liability shift.

Writing a Customer Notice That Limits Phishing Follow-Ups

The FTC's guide includes a model data breach notification letter, which makes a sensible starting point. Some states require specific content, so have counsel review your draft.

Per franceinfo, Intermarché's email told customers not to click suspicious links and to watch for calls or messages that might use their personal data. Go a step further and make the notice itself a defense against impostors.

Include:

• What happened and when, in plain language.
• Exactly which data was involved, and which wasn't.
• What you've done to contain it.
• What customers should do next, such as watching statements, resetting passwords and being wary of unexpected contact.
• One verified way to reach you, such as the phone number printed on your receipts or a page on your own website.

Spell out your anti-phishing commitments:

• "We will never call or text you to ask for your card number, PIN or password."
• "This notice contains no links asking you to log in." Then make sure that's true.
• "If someone contacts you claiming to be from [Store Name] about this incident, hang up and call the number on our website."

Illustrative example: A neighborhood grocer finds that someone accessed its online pickup order database. Its notice lists the exposed fields (names, phone numbers, pickup history). It confirms that a separate gateway processed the cards and that card numbers weren't stored. It also tells customers the store will never text them asking for payment updates on past orders.

Brief your staff as well. Cashiers and phone staff will get questions, and scammers may call the store pretending to be customers. Our article on social engineering lessons for merchants has scripts worth reusing.

Lower Your Exposure Now: Data Minimization and Vendor Access Reviews

The cheapest breach to handle is one that involves only data you never kept.

Data minimization checklist:

• Do you need birth dates, or just a flag showing age was verified?
• Can you delete old pickup and delivery order history after a set period?
• Are e-receipt email lists kept separate from loyalty and order data?
• Has your provider confirmed that your POS and online checkout don't store full card numbers and that payments are tokenized?
• Are exported customer spreadsheets sitting in shared drives or old email threads?

Vendor access review:

• List every vendor with access to your POS, e-commerce admin, loyalty platform or network. Include IT contractors, marketing agencies and delivery integrations.
• Remove access for vendors you no longer use and for former employees.
• Require unique logins and multi-factor authentication. Don't allow shared "admin" accounts.
• Ask key vendors how they would notify you of a breach on their side, and how quickly.

While you're reviewing your setup, check whether your POS systems and online payment gateways keep card data out of your environment. Grocers should also check how scales, EBT and pickup workflows connect to customer records. Our grocery store POS buyer's guide covers what to look for.

Next Steps

1. Write a one-page incident plan this week. Cover who leads, who to call (processor, counsel, insurer) and where logs are kept.
2. Map which states your customers live in, especially if you sell online.
3. Draft a template customer notice now, with the anti-phishing lines already included.
4. Run the data minimization and vendor access checklists every quarter.

MannyPay supports payment processing for grocery markets, retail and e-commerce businesses, with POS systems, gateways and 3-D Secure options. To talk through how your current setup handles card data, request a free quote, and a MannyPay specialist will respond within one business day.

This article is general information, not legal advice. Breach notification laws vary by state and change often. Confirm your obligations with a qualified attorney.

Sources

1. Intermarché Falls Victim to Cyberattack: 300,000 Customers Affected (RetailDetail EU)
2. Intermarché Data Breach Affects Nearly 300,000 Customers (ESM Magazine)
3. Intermarché victime d'une cyberattaque visant les fichiers clients associés à son service Drive (franceinfo)
4. Cyberattaque d'Intermarché : près de 300 000 clients Drive touchés (L'Usine Digitale)
5. Why Your Personal Data Could Be at Risk After This Massive Cyberattack (Futura-Sciences)
6. Des magasins Système U, Intermarché, E.Leclerc et Monoprix touchés par une cyberattaque contre leurs installations frigorifiques (franceinfo)
7. Data Breach Response: A Guide for Business (FTC)
8. Responding to a Data Breach: The FTC's Guide (Consumer Financial Services Law Monitor)
9. What to Do When You Suspect a Data Breach (FTC press release)
10. Summary Security Breach Notification Laws (NCSL)
11. Data Breach Notification Laws: State-by-State Reporting Timelines (Coggno)
12. New York Tightens the Breach Clock: 30 Days to Notify (Morrison Foerster)
13. Data Breach Notification Laws by State (CyberRiskPolicy)
14. 50 State Guide to Data Breach Notification Requirements (L Squared Insurance Agency)

ME

About the author

MannyPay Editorial Team

Beyond the Swipe's editorial desk researches the publication's guides and news and cites its sources in every article. Articles reviewed by a named MannyPay editor carry that editor's byline.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.