A hacker went after 15,000 Illicado gift cards given to employees

A digital gift card often boils down to a PDF file: a name, an amount, a number, a code. On November 1, the attacker targeted exactly the service that produces those PDFs at Illicado, the multi-retailer gift card issuer operated by the company ILLI&CO in Croix, in northern France.

On Friday, November 6, the company confirmed to AFP (Agence France-Presse) that it had been hit by a cyberattack affecting 15,000 digital cards, bought in 2025 and 2026 and not fully spent. The French Breaches site first reported the incident. Companies buy these cards to give to their employees, for example at Christmas.

What did the copies contain?

In an email sent to its customers on Thursday, November 5, Illicado describes a “targeted, automated cyberattack” against “the service that generates the e-cards' PDF documents.” The attacker bypassed the service's protections and obtained copies of cards that had already been issued. According to the letter cited by French Breaches, these documents included the recipient's first and last name, the full card number, its security code, its amount and the personalized message entered at the time of the order. According to the company, they contained no email address, postal address or phone number.

In other words, whoever holds a copy could spend the balance before the legitimate recipient does. Illicado declined to say how much money was at stake. For a single customer cited by French Breaches, 16 cards across three orders were affected, with a total balance of €3,295.76.

Have any cards already been spent?

Accounts differ. “For the moment, no payment has been made” with the affected cards, Illicado told AFP. According to French Breaches, however, Illicado's letter to its customers acknowledges that some cards were used fraudulently before they were blocked, without giving the amount. We were unable to determine which version is correct.

According to the timeline in the letter as reported by French Breaches, the compromised cards were blocked on November 2 and a security patch was deployed on November 3. The company has deactivated the old e-cards and is sending each recipient a new card credited with the exact balance at the time of the incident. A complaint has been filed with the Paris prosecutor's office, and the breach has been reported to the CNIL (the French data protection authority).

What employees and employers should do

For recipients, Illicado is clear: “No action is required,” and no one should suffer a loss. A few precautions are still worthwhile:

• stop using the old card and wait for the new one, which Illicado will send;
• be wary of any unexpected message asking for information or a payment related to this replacement, and check with your employer or your works council (comité social et économique, CSE);
• report to your employer any balance that does not match the amount you were given.

For corporate customers, the situation is different. Illicado acts as a processor under the GDPR. So it is the company or the CSE that bought the cards, as the data controller, that must notify the CNIL of the breach within 72 hours if it poses a risk to employees, and record it in its internal breach register. Illicado has warned that it will not make these notifications on behalf of its customers.

With year-end orders only weeks away, one question remains open: how many cards could the attacker actually spend, and for how much? Illicado has not yet said.