3,204 accounts affected by claimed data leak at FranceVerif.fr

On 11 April 2026, FranceVerif.fr — a French anti-scam service that rates the trustworthiness of e-commerce sites and aggregates merchant reviews — was named in a data-leak claim posted to the DarkForums cybercrime forum under the title "DATABASE | 35.820 FranceVerif.fr". The post offered a database said to be exfiltrated from the platform, provided in JSON, JSONL and CSV formats.

According to the claim, the dataset covers both review authors and merchant accounts. A conservative deduplication by normalized email yielded at least 3,204 affected accounts, with an upper bound of 4,387 email addresses once generic merchant contact addresses are included. The combination of identity, contact and review data would be useful for spam, targeted phishing or impersonation.

The categories of data reportedly exposed include:

• Identity: first and last names, display names
• Contact details: email addresses, phone numbers, postal addresses, cities, postal codes, countries
• Business data: company name, role, SIRET and VAT numbers
• Reviews and user content: ratings, review text, replies, experience dates, decisions
• Technical metadata: partially masked IP addresses, user-agent, browser, version, operating system, device type
• Internal account data: userId, uid, status, plan
• Commercial data: offers, coupons, gift cards, affiliate links, categories/domains, partners

As of reporting, the incident is at the claimed stage: the figures and contents come from the attacker's post as catalogued by the French breach tracker Fuites Infos, and FranceVerif had not publicly confirmed a breach. Its scale and authenticity remain unverified.