20,000 customers affected by the Multi-French-Real-Estate-Agencies data leak

On 28 January 2026, eleven French real estate agencies — a cluster of independent agencies and property-management firms, several of them part of the Orpi franchise network — were named in a single mass data leak put up for sale on a criminal hacking forum. The dataset advertised more than 500 GB of data spread across 1,183,761 files, with the breached archives reportedly spanning 2015 to 2026.

A cybercriminal claimed to be selling a consolidated database drawn from agencies including Orpi AFG Immobilier (Voiron), Trenta Immobilier, Marteau Immobilier, Aix La Duranne Immo, BLG Patrimoine and SB Immobilier, alongside other rental-management and co-ownership (syndic) structures. At least 20,000 individuals — owners, tenants, co-owners and suppliers — are estimated to be affected. The AFG Immobilier portion alone was reported at roughly 85 GB and more than 200,000 files.

The exposed records combine personal, real-estate, contractual, financial and documentary data, including:

• Full names and contact details (addresses, phone numbers, emails)
• Identity documents and client/employee identifiers
• Leases, rental mandates and co-ownership documents
• Bank details (IBAN) and payment records
• Internal documents, and in at least one case video-surveillance and voicemail content

The data was being offered for sale rather than published in full, and no coordinated remediation or regulatory outcome had been confirmed at the time of reporting. Given the volume, the long retention window and the sensitivity of the documents, the leak represents a significant exposure event for the French real estate sector, with affected individuals at elevated risk of phishing and identity fraud.