1,342,952 Stych customers affected by a data leak

On 8 March 2026, Stych — a French online driving school (auto-école en ligne) — was the subject of a fresh data leak after a threat actor advertised a database of 1,342,952 customer records for sale on a hacking forum. The roughly 0.9 GB dataset was presented as unprocessed customer information drawn from the platform's registration and training systems.

The same actor behind this listing has been linked to other contemporaneous French breach claims. Stych had already notified users of a security incident in late 2025, telling them it had reinforced its security controls and informed France's data-protection regulator (CNIL); this March 2026 dump appears to be the public circulation of that compromised dataset.

The exposed records included:

• Full names and identity/profile fields
• Email addresses
• Mobile and landline phone numbers
• Postal addresses, postal codes and cities
• Dates of birth and nationality
• Driving-training attributes and account-status indicators

Banking data, identity documents and passwords were reported as not part of the exposed set. The principal risk is targeted phishing: with registration and licence-related data in hand, attackers can craft "permis de conduire" SMS and email lures that closely imitate legitimate Stych or ANTS communications. Affected customers were urged to be wary of unsolicited messages and calls in the weeks following disclosure.