Subcontractor account-compromise enabled illegal data extraction including names, emails, phones, and support messages; regulators notified.

A French online DIY marketplace is warning that nearly 38m of its customers may have had personal data exposed after hackers breached one of its external customer service providers in January 2026.

The firm, ManoMano, announced on 26 February 2026 that attackers had gained unauthorized access through an account belonging to a subcontractor handling customer support, allowing the “illegal extraction” of data tied to customer accounts and service interactions on its platform.

Exposed information can include customers’ names, email addresses, phone numbers, and the contents of messages exchanged with customer service, although the exact data breached can vary by individual case. Passwords and payment data were not affected, and the compromised account had been blocked on the day the breach was discovered. The supply chain subcontractor’s network access had also been revoked, while internal and vendor access controls have been tightened.

Additionally, the firm has notified French and European regulators, including data protection and cybersecurity authorities, and is sending alerts to affected customers with advice on spotting phishing and social engineering attempts, verifying incoming emails, and monitoring bank and card accounts for suspicious activity.

While ManoMano has publicly described the impact in general terms, a threat actor using the alias “Indra” claims to have stolen data from the firm’s Zendesk-based support platform, and is reportedly offering a 43GB dataset on a hacking forum, allegedly containing 37.8m user accounts, about 935,000 after‑sales tickets, and more than 13,500 attachments spanning France, Spain, Italy, Germany, and the U.K.

Security researchers say the alleged figures broadly match ManoMano’s disclosure that roughly 38m customers may have been affected by the third‑party breach. According to one report by The Register,  while the breach has been framed as a subcontractor incident (also known as a ‘supply chain attack’), the alleged scale of the compromise suggests the subcontractor would have had access to a substantial volume of customer data — a potential non-compliance with Article 5(1)(c) of the EU GPDR.