23,685 records: claimed leak at ATOA

On 21 May 2026, ATOA — a French fintech operating a real-estate tokenization and fractional-investment platform (atoa.io), which lets retail investors buy fractions of property projects in France and Spain in euros or crypto — was hit by a claimed data leak after a threat actor advertised a copy of its database for sale on a dark web cybercrime forum.

The exact intrusion vector has not been publicly confirmed. The actor offered what was described as a production database dump alongside an identity-validation archive, the contents of which point to compromised customer, financial and compliance data rather than a simple service disruption.

The exposed data is reported to include:

• Roughly 23,685 tabular records covering user profiles (names, emails, phone numbers, postal addresses, dates of birth, nationalities, tax identifiers)
• Financial details: IBANs, crypto wallet addresses and balances, transaction histories, invested capital, interest and tax categorization
• Around 10,000 transaction rows referencing MangoPay payment infrastructure
• 326 full KYC archives containing passports, national ID cards, RIB/IBAN banking certificates, Kbis corporate filings and proof-of-address documents

Because the dataset combines verified identity documents with banking data, it carries a high risk of identity theft and financial fraud for affected users. The breach was surfaced on underground forums around 22 May 2026; ATOA's containment and notification response had not been publicly documented at the time of reporting, so the status remains unknown.