175,942 people exposed in the Eiffage (NextSend) data leak

On 25 February 2026, Eiffage — one of France's largest construction and public-works (BTP) groups — was named on the LAPSUS$ extortion collective's leak channel, which claimed to have exfiltrated and published a database from NextSend, the large-file-transfer platform (edited by Hegyd) used internally by the company.

The compromise affected the third-party NextSend service rather than Eiffage's core systems. LAPSUS$ released 77 files containing structured extractions from the platform — accounts, contacts, sending history, connection traces, and billing/prospecting records. In total, 175,942 individuals were exposed: roughly 50,336 internal Eiffage employees and 125,606 external contacts (clients, subcontractors, partners and file recipients).

Exposed data categories included:

• User login logs with IP addresses, browser and device information
• Client and prospect details (SIRET numbers, VAT identifiers, revenue figures, satisfaction ratings)
• Contact lists and file-sharing activity logs (downloads, read receipts)
• Administrator account credentials, stored as bcrypt and SHA-512 hashes

The most immediate risk for those in the database is highly credible targeted phishing and business fraud, given the combination of names, professional addresses and detailed financial identifiers. Eiffage published a dedicated fraud-warning page on its website acknowledging the incident and alerting affected individuals and business partners.