Leak at Alfortville town hall (via RDV360)

On 19 November 2025, Alfortville town hall — a municipality in the Val-de-Marne, near Paris — began notifying residents that their personal data had been exposed in a breach not of its own systems but of RDV360, the third-party platform it used for booking administrative appointments (identity cards, passports, and similar services).

The incident was a supply-chain compromise. Attackers reportedly used a municipal employee's login credentials — harvested in an unrelated earlier breach — to access a RDV360 client account, then exploited a flaw in the platform's appointment-and-reservation module that allowed unauthorised bulk export of records. The campaign, active around September–October 2025, struck roughly 1,300 French municipalities through RDV360 and a second provider, SynBird, exposing on the order of 14 million records spanning appointments from 2021 to November 2025. A group calling itself "dumpsec" was linked to the operation.

Data exposed for affected residents was limited to:

• First and last name
• Email address
• Phone number
• Postal address

RDV360 stated that no sensitive data, identity documents, financial information, or passwords were taken. The provider said it had patched the vulnerability, notified France's data-protection authority (CNIL), and filed a criminal complaint; affected towns including Alfortville issued vigilance warnings to residents about possible phishing.