66,000 users: data leak claimed at CCAS de Dunkerque

On 31 January 2026, Dunkirk CCAS — the Centre Communal d'Action Sociale, the municipal body that delivers social assistance to vulnerable residents of Dunkirk in northern France — was named as the victim of a claimed data leak after a threat actor advertised a stolen database for sale on a hacking forum.

The actor claimed to have accessed the database used to manage users, households and social-action case files, and to be offering the personal data of roughly 66,343 people assisted by the CCAS. The dataset reportedly included around 40,406 unique phone numbers and 13,098 unique email addresses.

The categories of exposed data reportedly included:

• Full names (first and last)
• Email addresses
• Phone numbers
• Dates of birth
• Postal addresses
• Family situation / household profiles
• Administrative information tied to social-assistance files

Because the records concern beneficiaries of social welfare, the exposure puts an already vulnerable population at heightened risk of phishing, targeted scams, identity theft and exploitation of sensitive personal circumstances. The claim originated from a single actor and, as of reporting, the breach had not been independently confirmed by the CCAS; the status remains unverified.