Threat watch / Breach
Ninkasi: unauthorized access to the online shop exposes customer data and old-format passwords
French company Ninkasi told its customers that its online shop, shop.ninkasi.fr, was accessed without authorization on November 12, 2026, and that it detected and blocked the intrusion the same day. Names, contact details, order histories and customer account passwords stored in an old format may have been exposed; payment data is not concerned, according to the company. Customers must set a new password at their next login.
- Sector
- Retail
- Way in
- Not public yet
- Product or vendor
- None named
- How it happened
- Not public yet Checked 15 Nov 2026
- What was stolen
- Data that "may have been exposed", according to the notice described by Cyberattaque.org: first and last names, email and postal addresses, phone numbers, order histories, and customer account passwords stored in an old format. Ninkasi says payment data is not concerned. It does not say whether data was actually copied.[1][2] Checked 15 Nov 2026
- Who was impacted
- Customers of the Ninkasi online shop. The notice gives no number of people affected.[1] Checked 15 Nov 2026
- Threat actor
- Not attributed
Timeline
- Unauthorized access to the online shop shop.ninkasi.fr. The company says it detected and blocked the intrusion the same day. The attackers' method is not disclosed. [1]
- The Bonjour la fuite tracker lists the leak: name, postal address, email, phone and order history. [2]
- Cyberattaque.org, which obtained a copy of the customer notice, reports that passwords stored in an old format may also have been exposed, and that customers are asked to create a new password at their next login. [1]