Hackers claim to hold Alain Afflelou customer records and threaten to leak them

On the evening of October 26, a new name appeared on the site where the Emperador ransomware group lists its victims: Afflelou. Next to it were a countdown and an announced file, afflelou_leak.txt, of 11.1 MB. The group threatens to publish customer data from the optical and hearing-care retailer when the deadline expires.

The key facts: the claim was spotted by Cyberattaque.org and by the tracking site Ransomware.live. It has not been confirmed by Alain Afflelou or by any authority. At this stage, the number of customers affected, the source of the data and its date are all unknown.

What do the hackers' screenshots show?

According to Cyberattaque.org, which viewed the group's page, the published sample shows customer records: name, date of birth, age, sex, email address, phone number and postal address. They also include internal identifiers and the history of orders, payments, deliveries and subscriptions. One sample record shows three orders and three payments dating back to 2021.

Cyberattaque.org found no full bank card number and no prescription or detailed medical data in the screenshots. It notes that an identifier in the Salesforce format, a customer relationship management software, does not mean that Salesforce was hacked. The announced file is also small: 11.1 MB says nothing about the real number of records.

A third alert in a year and a half

This is not the first time Afflelou's name has come up in a data case. In April 2025, the retailer acknowledged a leak through a customer relationship management provider: civil status, contact details and commercial information, with no banking or medical data according to the company, which notified the CNIL (the French data protection authority). On October 17, 2026, a hacker also released nearly 50,000 billing lines tied to a former portal reserved for the retailer's professional customers. No link has been established between these episodes and Emperador's claim.

Emperador, active since the summer of 2026 according to tracking sites, operates with affiliates, according to Escudo Digital, which cites a profile of the group compiled by the company Devil Group. It first steals data, then encrypts systems, then threatens to publish everything if the victim does not pay. Nothing currently makes it possible to say that Afflelou's systems were encrypted.

What to do if you are a customer

Even if nothing is confirmed, this type of file is mainly used to make scams more convincing. A fake message that cites your latest order or your subscription is harder to spot.

• Be wary of emails, texts or calls in Afflelou's name that mention a refund, a payment problem or an order to be regularized.
• Do not click on links: go through the official website or call your store.
• No one should ask you for your banking codes or for a code received by text message.

Like Clin d'œil Opticiens before it, the retailer will have to say whether its customers should be notified. When Cyberattaque.org viewed the page, Emperador's countdown still showed more than seven days.