3,600 Gustave-Auto customers affected by a claimed data leak

On 13 February 2026, Gustave-Auto — a French automotive services platform offering vehicle convoyage (transport), geolocated fleet management and repair services — was reported as the victim of a claimed data leak affecting its registered partners. A breach tracker entry put the exposure at around 3,600 data records.

The company subsequently confirmed the incident publicly. It said it was alerted on 17 February 2026 by a cybersecurity monitoring service that data attributed to Gustave-Auto was circulating online. An internal investigation traced the leak to an access anomaly in its infrastructure, which the company says it corrected within an hour of detection. The cause was an access-control failure rather than a ransomware or extortion event.

The data potentially exposed concerned partners registered on the platform and included:

• Names
• Postal addresses
• Email addresses
• Phone numbers
• Banking details (IBAN, BIC)
• SIRET company-registration numbers
• VAT numbers

In response, Gustave-Auto ran a full audit of the data-access rules across its infrastructure, restricted platform access to France as a precaution, notified the French data-protection authority (CNIL), and individually emailed all potentially affected partners. A dedicated contact (dpo@gustave-auto.com) was set up for inquiries. The exact number of affected partners was not confirmed by the company; the 3,600 figure originates from the tracker's claim.