Leak at Centre Communal d'Action Sociale de Dunkerque

On 5 February 2026, the Centre Communal d'Action Sociale (CCAS) de Dunkerque — the municipal social-welfare agency for the northern French city — was named in a data breach after a threat actor advertised the sale of a stolen database on a cybercrime forum. The set was said to contain the personal records of 66,343 people supported by the CCAS, the public body responsible for social aid to vulnerable residents.

The leak was reported through breach-tracking services rather than via a CCAS statement, and the data appeared to come from the agency's beneficiary management records rather than a public-facing site. It is distinct from the January 2026 Lynx ransomware claim against the Ville de Dunkerque; this incident is a database offered for sale, not an extortion of the city.

Exposed data categories reportedly included:

• Surname and first name
• Date of birth
• Postal address
• Phone number (tens of thousands of unique numbers)
• Email address (thousands of unique addresses)
• Household profile and family situation
• Administrative details tied to social assistance

Because the affected individuals are social-aid recipients, the combination of identity, contact and family-situation data raises a heightened risk of targeted phishing, scams and identity theft. As of reporting, the CCAS had not published a detailed public response and the incident's status remained unconfirmed.