Leak at Quimper town hall (via RDV360)

On 24 November 2025, Quimper town hall — the municipal authority for the Finistère city in Brittany — disclosed that residents' personal data had been exposed through a breach at RDV360, the third-party platform it used to manage online appointments. The incident was part of a wider supply-chain compromise that affected roughly 1,300 French municipalities across the RDV360 and Synbird booking services.

The attackers did not break into the town hall's own systems. According to reporting on the wider campaign, an intruder reused credentials from an earlier breach to access a municipal staff account on the provider's platform, then abused a weakly protected PDF-export function to extract appointment data in bulk. For Quimper, the exposure covered around 12,000 contact records belonging to people who had requested national ID-card or passport renewals since 18 April 2024.

The exposed data was limited to contact details supplied when booking an appointment:

• First and last name
• Postal address and postal code
• Email address
• Phone number (landline or mobile)

The city stressed that no sensitive data, identity documents, financial information, or passwords were taken. In response, Quimper temporarily disabled its online appointment system (offering phone booking instead), filed a criminal complaint and notified France's data-protection regulator (CNIL). RDV360 also filed a complaint and is cooperating with the national cybersecurity agency ANSSI and the Paris prosecutor. Residents were warned to stay alert to phishing attempts by email, SMS, or phone and to report incidents to cybermalveillance.gouv.fr.