Leak at I-Cad
I-Cad, France's national dog, cat and ferret identification registry, disclosed in March 2026 that a September 2025 software vulnerability had allowed automated querying of its database, exposing users' email addresses and fuelling phishing campaigns against pet owners.
- Victim
- I-Cad
On 23 March 2026, I-Cad — operated by Ingenium animalis, the operator of France's mandatory national identification file for dogs, cats and ferrets — issued a public notice to its users about a security incident. The disclosure was prompted by a wave of phishing messages in which pet owners received emails containing some of their own personal data, suggesting that information held by the registry had leaked.
I-Cad traced the issue back to September 2025, when its teams identified a software vulnerability that could have allowed certain records in the database to be queried in an automated fashion (mass scraping). The operator said the flaw was contained as soon as it was discovered and that technical measures were deployed to prevent any recurrence.
The data potentially exposed was limited to:
- Email addresses
I-Cad reported the September 2025 incident to France's data protection authority, the CNIL, under Article 33 of the GDPR. At the time of disclosure the operator said it had found no confirmed fraudulent use of data originating from its systems, but warned that the recent phishing attempts indicated a residual risk of personal data being reused. It reminded users that legitimate emails only come from contact@i-cad.fr, contact.pro@i-cad.fr or noreply@i-cad.fr, and asked recipients of suspicious messages to report them to dpo@i-cad.fr.