Bureau Vallée admits hackers took its customers' sales receipts

On August 9, a hacker using the name “ZeroBytes” posted a file called clients.jsonl on a forum. The hacker attributed it to Bureau Vallée, the office supplies store chain, and claimed to have extracted 55,949 customer records through one of the retailer's application programming interfaces, covering 21,921 distinct people, according to the site Cyberattaque.org. Twelve days later, a second hacker, “misere,” upped the claim: 13.7 million rows, reduced to 4.82 million entries once duplicates were removed.

On August 18, CEO Adrien Peyroles mentioned about 22,000 affected customers, Cyberattaque.org reports. Nearly three months after the claims, the retailer goes further. In an email to its customers, whose content Cyberattaque.org and the site Presse83 published on November 5, Bureau Vallée acknowledges two separate security incidents. Both took place at the provider that supplies its checkout and management software. The company does not name the provider and gives no dates.

Sales receipts and loyalty vouchers

According to the retailer, the first incident involves a limited volume of customer records extracted from a management software: last name, first name, postal address, email address and phone number.

The second is much larger. An unauthorized person accessed the databases and files hosted by the provider. They extracted sales-related files: sales receipts, loyalty vouchers and customer data. That is enough to reveal what each person bought and how they use the loyalty program.

Bureau Vallée says its online store is not affected: not the accounts, not the passwords, not the order history. Bank card data, held by payment providers, is also spared, according to the company.

How many customers are affected?

The question remains open. Bureau Vallée confirms neither the claimed volumes nor any link between its two incidents and the two hackers. The figure of 4.82 million calls for caution: a row without duplicates does not necessarily correspond to one person. The published articles mention no complaint filed and no notification to the CNIL (the French data protection authority).

As with the leak through the Misterbooking hotel booking software, the flaw was not at the brand known to the public, but at a subcontractor.

What to do

Here, according to the retailer, no passwords or bank cards are out in the wild. The danger comes from elsewhere: a scammer who knows your store and your recent purchases can write a very convincing message.

• Be wary of emails, texts or calls in Bureau Vallée's name that mention a refund, loyalty points or an invoice, even if they cite a real purchase.
• Do not click links you receive: type the website address yourself or contact your store.
• Business customers: verify through another channel any unexpected invoice or any request to change bank details.
• Never give a code received by text or your bank details to someone who contacts you.

It remains to be seen who this provider is, and whether it also works for other retailers. Bureau Vallée has not said.