47,561 subscribers - claimed data leak at Philharmonie de Paris

On 6 January 2026, the Philharmonie de Paris — France's flagship concert hall and cultural institution at the Cité de la Musique — saw a database from its "Philharmonie à la Demande" (PAD) online music service published on a leak forum. The exfiltration is believed to have taken place around 25 December 2025, and the dataset was posted publicly on 6 January by an actor using the handle HexDex2.

PAD is a digital music resource and streaming platform used through partner libraries and médiathèques across France, with an audience that includes teachers, students, and librarians. The leaked file contained 47,561 unique accounts spanning users in cities such as Paris, Marseille, Lyon, Lorient, and across Calvados.

Exposed data categories reported include:

• Names and surnames
• Email addresses
• Login identifiers
• Professional profiles (e.g. teacher, student, librarian)
• Account creation and last-login dates
• In some cases, an associated partner site (e.g. CIMU)

The combination of identity, contact details, and professional status creates a credible targeted phishing risk, since attackers can reference a victim's city or role to craft convincing fraudulent messages. As of the disclosure, the institution had not published a detailed public statement, and the response status remains unconfirmed.