Leak at Brest town hall (via RDV360)

On 17 November 2025, the Brest town hall — the local authority for the Breton city of Brest — disclosed that around 50,000 residents had personal data exposed through a breach of RDV360, the third-party platform it used to manage online appointments for national identity cards and passports.

The incident was a supply-chain compromise: rather than attacking the town hall directly, criminals breached the appointment-booking provider RDV360, exposing data held on behalf of hundreds of French municipalities. The cybersecurity researcher SaxX linked the leak to the "dumpsec" extortion group and estimated that 500 to 600 communes using RDV360 were affected, totalling data on roughly 7 million citizens. The records pertained to identity-document appointments booked at Brest's central and six district town halls between 2 October 2023 and the breach's detection.

Exposed data for the affected Brest residents included:

• First and last name
• Postal address
• Email address
• Phone number

The town hall immediately suspended its online appointment system, notified France's data-protection regulator (CNIL), filed a criminal complaint, and said affected individuals would be contacted directly. It urged residents to stay alert to phishing and fraud using the leaked contact details. RDV360 reported the breach to ANSSI and the Paris prosecutor's cybercrime unit (OFAC).