Leak at Chatou town hall (via RDV360)

On 24 November 2025, Chatou town hall — a commune in the Yvelines department west of Paris — was named among the victims of a large-scale data breach affecting RDV360, a third-party online appointment-booking platform used by French municipalities for national ID-card and passport requests. The leaked records were those of residents who had booked identity-document appointments through the service.

The breach was not a direct compromise of the town hall. Attackers reused a municipal employee's credentials (obtained from an earlier, unrelated leak) to log into a RDV360 account, then exploited a flaw in the platform's software to mass-export resident data. The data spanned appointments made between roughly 2021 and November 2025. A cybercriminal group calling itself "dumpsec" is credited with orchestrating the operation.

Exposed data categories for affected residents typically included:

• First and last name
• Postal code and city
• Email address
• Phone number

Investigators described the exposed information as non-sensitive: no identity documents, financial details, or passwords were taken. Across all affected providers (RDV360 and the similar SynBird platform), roughly 1,300 municipalities and on the order of 14 million records were implicated; the count attributable specifically to Chatou was not separately published. Affected municipalities were required to notify France's data-protection authority (CNIL) and to file complaints with the gendarmerie. Access via the compromised provider was cut off, making the incident contained at the provider level.