Leak at La Carte Avantage Jeune

On 9 February 2026, the leaked database behind the Carte Avantages Jeunes — the youth-benefits card run by the public body Info Jeunes Bourgogne-Franche-Comté (CRIJ) — was catalogued as being offered for sale on the dark web. The underlying intrusion took place on 8 January 2026 and was first disclosed by the organisation on 19 January, when it warned cardholders of a "security incident."

An attacker exfiltrated the platform's user database and the supporting documents members had uploaded to obtain the card. Listings later surfaced on dark-web forums (under the pseudonym "HexDex2") advertising the data of some 282,900 users — about 480,000 raw records once duplicate yearly registrations are counted — alongside roughly 56,000 uploaded documents totalling around 92 GB.

Exposed data included:

• First and last name, date of birth
• Postal address and phone number
• Scanned identity cards
• Birth certificates
• Handwritten signatures

The organisation initially characterised the leak as limited to "identification information" and stressed that no banking details, passwords or financial data were involved. It secured its systems on detection, notified the regional cybersecurity centre (CSIRT-BFC) and the CNIL, and alerted cardholders by SMS and email on 19 January, urging them to change their passwords. The avantagesjeunes.com service remained operational throughout.