828,000 stop-points exposed in data leak at Loxam

On 4 February 2026, Loxam — Europe's largest equipment-rental group, headquartered in France — disclosed that customer, employee and partner data had been exfiltrated through a third-party software platform used to plan its equipment deliveries. The company described the incident as circumscribed and closed, and said it was in the process of notifying the relevant authorities.

The breach did not hit Loxam's core systems directly but its transport-management and route-planning system (TMS) operated via an outside provider — making this a supply-chain exposure. Roughly 60 GB of logistics data spanning January 2020 to early 2026 was reported to have been compromised, affecting Loxam's French operations.

The exposed dataset included:

• 94,735 delivery routes and around 828,000 geolocated stop-points
• Roughly 89,420 unique client businesses and 53,165 vehicle registration plates
• More than 244,000 phone numbers
• Driver full names and personal/professional phone numbers
• Precise GPS coordinates, full delivery addresses and site-access instructions
• Activity logs, timestamps, delivery signatures and operational comments

Because Loxam's delivery network serves major French firms and public institutions, the leaked routing and access data raised concerns about indirect mapping of sensitive sites. Loxam stated that, based on its investigation, none of the affected data was of a nature likely to harm its customers, and that the incident had been contained.