Bordeaux Métropole: leak of 11,000 tourist tax filers and tourist rental addresses

On 27 April 2026, Bordeaux Métropole — the metropolitan authority covering Bordeaux and its surrounding municipalities in the Gironde — was reported to have suffered a data breach affecting its tourist tax (taxe de séjour) declaration service hosted at taxedesejour.bordeaux-metropole.fr.

A threat actor published a partial database, shared as a roughly 3.1 MB JSON file, that they attributed to the portal used by holiday-rental operators to declare and pay the local tourist tax. The structured JSON format suggested a direct extraction from the underlying declaration database. The exact intrusion vector was not disclosed.

The leak covered approximately 11,000 accommodations or declarants. Exposed data categories included:

• Declarant first and last names (and salutation)
• Email addresses
• Phone and mobile numbers
• Declared property (rental) addresses, postal codes and municipalities
• Accommodation registration numbers and declaration dates

The City of Bordeaux and the metropolitan authority subsequently communicated publicly about the incident and notified affected declarants by email, urging them to stay vigilant against phishing and fraud that could exploit the exposed administrative details. Because the data combines identities with contact details and property addresses, the main risk is targeted phishing, SMS scams, identity theft and social engineering against rental owners.