Leak at Info Jeunes Bourgogne Franche-Comté

On 19 January 2026, Info Jeunes Bourgogne Franche-Comté — the regional youth information service (CRIJ) that operates the "Carte Avantages Jeunes" discount card — disclosed a security incident that had occurred on 8 January 2026 and exposed the personal data of its cardholders.

A threat actor using the alias HexDex2 put the stolen database up for sale on a dark-web marketplace, releasing a free sample of about 1,000 identities to prove its authenticity. The listing claimed 282,906 user records; because of annual renewals and duplicated entries, the organization estimated that between 100,000 and 150,000 distinct people were realistically affected, many of them young and some minors.

Exposed data was limited to identification and contact information. According to the CRIJ, no sensitive data was compromised:

• Full names
• Postal addresses
• Phone numbers
• Dates of birth

The organization stressed that no banking details, passwords or financial information were involved. Services on the avantagesjeunes.com platform remained fully operational, and the CRIJ urged all holders with an online account to change their passwords as a precaution while it reinforced its security measures. The regional authority issued statements (19–21 January) seeking to reassure users, framing the incident as contained.