Leak at 11 real estate agencies

On 28 January 2026, 11 French real estate agencies — a cluster of independent and Orpi-network agencies — saw a vast trove of their data offered for sale on a cybercrime forum. An anonymous attacker advertised roughly 1.18 million files totalling more than 500 GB, exposing the records of an estimated 20,000+ property owners, tenants, co-owners and suppliers.

The named agencies include SCI Foncière de la Tourelle, Aix La Duranne Immo, Marteau Immobilier (Orpi), AFG Immobilier, OC Investissement, Trenta Immobilier, BLG Patrimoine, SB Immobilier, Sun Immobilia, Immovalie and SAS Immo. AFG Immobilier (Voiron, Isère) was separately reported to have lost some 85 GB and over 200,000 files. The fact that so many distinct agencies were compromised at once points to a shared software or service provider as the likely common point of failure, though the exact attack vector has not been confirmed.

The exposed data was extensive and highly sensitive, reportedly including:

• Names, postal addresses, email addresses and phone numbers
• Logins and passwords
• IBANs and banking details
• Rent receipts, invoices and contractual data
• Maintenance logs, marketing campaigns and financial reports
• Minutes of co-owner general meetings (and, for AFG, video-surveillance and voicemail content)

At the time of reporting, none of the affected agencies or the wider profession had issued a public statement, and there was no confirmed response from France's data protection regulator (CNIL). The combination of identity documents, banking data and credentials creates a significant risk of fraud and identity theft for those affected. The incident is treated as ongoing.