Leak at La Centrale du Financement

On 28 November 2025, La Centrale de Financement — one of France's largest mortgage and credit brokers — was hit by a major data breach after a threat actor exfiltrated data from its corporate network. As a broker, the company sits between borrowers and major French banks and routinely collects the most sensitive financial documents an individual holds, making the exposed data especially damaging.

The attacker claimed to have stolen roughly 387 GB of data spread across about 411,000 files. Samples reviewed by security monitors were assessed as highly credible. According to the threat actor, negotiations with the company were attempted and failed, after which the dataset was put up for sale on a criminal forum for around $25,000 — a pattern consistent with a double-extortion scheme.

Exposed data categories reportedly included:

• Identity / KYC documents (passport scans, national ID cards, family record books)
• Financial proofs (bank statements, pay slips, tax returns)
• Loan and financing files, transaction records and partner financing agreements
• Notarial acts, insurance and legal documents, and electronic signatures
• Internal company data including emails and accounting records

The breach was first surfaced in late November 2025 and was being publicly tracked by December 2025 as the stolen data was marketed online. The number of distinct customers affected was not officially quantified, and the incident remained ongoing as the dataset circulated.