Armurerie Centrale Confirms Cyberattack Exposing Customer Data

A cyberattack targeting French online firearms retailer Armurerie Centrale has potentially exposed customers' personal information, purchase histories, uploaded documents, and protected password data. The company said the intrusion occurred in September 2026 and was discovered on October 1, prompting corrective measures, a complaint to authorities, and notification of France's data protection regulator.

The disclosure follows a series of cybercriminal data leak claims surrounding demonstrations and unrest in France on October 17. In an October 19 report, Journal du Net described alleged breaches affecting several organizations, including firearms-related entities, while Cyberattaque.org reported on October 20 that Armurerie Centrale had confirmed an intrusion affecting its website.

According to a customer notification obtained by Cyberattaque.org, an unauthorized third party accessed the retailer's website. The company said certain personal records and account information may have been viewed, but it did not establish that every listed category of information had been copied.

Armurerie Centrale characterized the intrusion as an "act of malice" in its notification. The company said it detected the incident on October 1, 2026, and subsequently took steps to address the vulnerability and strengthen server security.

The potentially affected information includes customers' names, email addresses, telephone numbers, birth dates, postal addresses, order histories, customer service correspondence, and documents uploaded to accounts. The company did not disclose the total number of affected customers or the precise volume of information involved.

Password information presents a separate concern. Armurerie Centrale said passwords were not stored in plain text, but a protected representation of them was stolen.

The notification described the stolen information as an "encrypted fingerprint." This description does not mean the passwords were directly readable, although the company recommended changing the password used on its website and on any other service where the same credentials had been reused.

The breach has particular privacy implications because the retailer sells firearms, ammunition, recreational weapons, and defensive equipment. If customer identities, home addresses, and detailed purchase records were accessed, their combination could expose individuals to targeted fraud or privacy violations.

However, being a customer of Armurerie Centrale does not necessarily mean a person owns a firearm. The company also has not established that all uploaded documents or historical purchase records were accessed during the incident.

Armurerie Centrale said it had fixed the vulnerability, strengthened server security, notified the Commission nationale de l'informatique et des libertés (CNIL), and filed a complaint. Cyberattaque.org reported these actions based on the customer notification, noting that it had not independently identified a separate public confirmation of the regulatory notification or complaint.

Separately, Journal du Net reported on October 19 that cybercriminals had claimed multiple data leaks linked to the October 17 unrest. The alleged targets included the French Shooting Federation, two firearms retailers, educational services, and other organizations. The report said the affected organizations had not confirmed those particular claims at the time.

One alleged leak attributed to hacker ChimeraZ involved information associated with 586,854 people connected to the French Shooting Federation. Other claims concerned 3,789 firearms owners linked to one unnamed retailer and 35,303 customers of another. The alleged records included identification photographs and postal addresses, but the organizations had not confirmed the claims.

Journal du Net also reported that hacker Angel_Batista claimed to have released 3,400 documents belonging to the Grande Loge Traditionnelle de France, alongside alleged leaks involving Nomad Education, Inter-Etab, Unione Italiana Tiro a Segno, and O-Tacos. Those organizations had not confirmed the reported exposures.

Thomas Lazzaroni, founder of cyberattack.org, said activity on cybercriminal channels before October 17 suggested that some hackers were preparing releases to coincide with the demonstrations. He identified Angel_Batista as a particularly active participant who frequently posted messages opposing the state.

Lazzaroni also described a change in ChimeraZ's publication pattern during the October 17 operation. He said the hacker released multiple databases throughout the late afternoon and evening rather than following the usual timing of publishing around midnight.

Among the other organizations mentioned in the reports, Malakoff Humanis acknowledged a data leak originating from a service provider that manages part of its insured population. The precise scope of the Armurerie Centrale incident, the number of affected customers, and the identity of the attacker remained undisclosed as of October 20, 2026. Cyberattaque.org also said the available evidence did not establish that the retailer's stolen data had been publicly released.