Alinto: a massive leak of 40 million emails hits CAC40 companies

On 8 April 2026, Alinto — a Lyon-based French provider of professional email and email-security services that processes close to 100 million messages a day — was reported to have exposed more than 40 million email-traffic records through a misconfiguration. The Cybernews research team found an Elasticsearch cluster that was publicly reachable without any authentication, hosted on the same server as an SMTP instance tied to Cleanmail, Alinto's anti-spam relay solution.

The exposed database held SMTP relay logs rather than the contents of messages. Across the 40 million records, researchers identified at least 4.5 million unique email addresses. Because Alinto routes mail on behalf of many client organisations, the leak spilled communication metadata belonging to major French firms and public bodies — including CAC40 names such as L'Oréal, Renault, Carrefour and Hermès, the logistics group DHL, and at least 14,000 French government addresses from embassies, local authorities and state services.

Data exposed included:

• Sender and recipient email addresses
• Precise message timestamps
• SMTP relay IP addresses and associated location data

No message bodies were exposed, but the metadata is enough to map corporate and government communication relationships and to craft targeted phishing and social-engineering campaigns. Cybernews discovered the open cluster on 24 February 2026 and disclosed it; although Alinto did not reply, the database was secured by 26 February, and the broader coverage of the incident landed in April 2026.