765 users affected by claimed leak at Média31

On 9 May 2026, Média31 — the online media-library platform (media31.mediatheques.fr) run for the network of departmental libraries of Haute-Garonne, France — was named in a data-leak claim posted by the threat actor AplaGroup. The intrusion was subsequently confirmed on 21 May 2026.

According to the elements published by the attackers, several vulnerabilities were identified in the platform, some of them rated critical, and were exploited to extract user data. Database excerpts were publicly disseminated, with around 765 user accounts appearing in the sample.

The exposed data reportedly relates to library patron accounts and associated administrative records, including:

• User account details enabling direct identification of affected individuals
• Authorized-access and account-activity information tied to the libraries

The volume is modest, but the exposed identifiers could facilitate targeted phishing or social-engineering attempts. Affected users were advised to change their passwords as a precaution, stay alert to suspicious emails or calls, avoid transmitting sensitive information, and monitor their accounts for unusual activity.