Leak at La Rochelle (via Synbird)

On 27 November 2025, the City of La Rochelle — a coastal commune in Charente-Maritime — disclosed that the personal data of residents who had booked civil-status appointments at its town hall was exposed online. The breach did not originate in the city's own systems but with Synbird, the third-party platform La Rochelle uses to schedule identity-document appointments, which serves roughly 1,300 French communes.

According to Synbird and press reporting, an attacker reused credentials from an earlier, unrelated leak to access a municipal agent's account on 24 October 2025, then exploited a vulnerability in the platform's PDF-export feature to extract appointment data. Synbird contained the incident on 27 October and notified the CNIL and ANSSI. In La Rochelle's case, 394 users who had requested an appointment in October 2025 were affected.

Exposed data categories:

• Last name and first name
• Email address
• Phone number
• Appointment date, time and location

Synbird stated that no passwords, identity documents or banking data were compromised. La Rochelle notified affected residents by SMS and email in mid-November, reported the incident to the CNIL, and filed a criminal complaint against persons unknown ("plainte contre X").