Leak at 123 casting

On 22 December 2025, 123 casting — a French online casting platform connecting aspiring actors and models with agencies and productions — saw a database of roughly 240,000 of its users published on the BreachForums leak forum. The dataset had reportedly circulated privately in the past before being released publicly, exposing the full profiles members had built on the site.

The leak appears to stem from a full compromise of the platform's database, with records spanning from 2015 to April 2024 — meaning much of the exposed data was still recent and active. A notable security failure is that account passwords were stored using the obsolete MD5 hashing algorithm, which is trivially reversible and leaves them effectively in plaintext.

Exposed data categories include:

• Full name, date of birth and gender
• Postal address, email address and phone number
• MD5-hashed (effectively plaintext) passwords
• Physical attributes: height, weight, eye and hair color, body measurements
• Ethnic origin and distinctive features (tattoos, scars)
• Photo and video books
• Private message history with agents and other users
• Payment data

The combination of precise identity, contact, physical and biometric details makes affected users especially exposed to targeted phishing, identity theft and harassment. As of the disclosure, no public statement or remediation from 123 casting had been confirmed, and the incident status remains unknown.