Djaboo: more than 25 GB of sensitive internal files published after a cyberattack

On 15 May 2026, Djaboo — a French SaaS platform for electronic document management, dematerialization and document workflows (djaboo.com) — became the subject of a large data leak when a threat actor published more than 25 GB of stolen internal files on a cybercriminal forum.

According to the attacker's own description, the dump includes a complete MySQL database export dated 1 May 2026 (roughly 15 GB uncompressed), alongside application archives containing source code, Git repositories, configuration files, backups, logs and client-uploaded documents. Because Djaboo's platform acts as a central document hub for many businesses and organizations, the breach exposes data belonging to its clients as well as the company itself.

The leaked data reportedly includes:

• A full MySQL database dump (CRM, accounts, application data)
• Records for 12,378 CRM customer accounts, 6,372 unique client companies and 13,578 unique individuals identified by email
• Email addresses tied to public bodies (e.g. CNIL, ADEME), financial institutions and large enterprises
• Application source code, Git repositories and configuration files
• Infrastructure backups, logs and client-uploaded files (including an "auth.zip" archive suggesting authentication material)

At the time of disclosure, the full scope of the compromise and the precise nature of the exposed data had not been officially confirmed, and no public response from Djaboo had been reported. The attack vector remains unknown. Observers flagged a high risk of follow-on identity theft, targeted phishing and credential-reuse attacks against the affected organizations.