Thales: thousands of employee records released publicly on a cybercriminal forum

On 12 May 2026, Thales — the French multinational specialising in defence, aerospace, space and digital identity — was named in a data leak published on a cybercriminal forum by a threat actor using the pseudonym ChimeraZ. The actor posted an 85 MB JSON file containing roughly 6,400 user profiles described as belonging to the group.

Analysis of the sample indicated the records did not come from Thales' internal systems but from LuxTrust, a Luxembourg-based digital-trust and electronic-signature provider whose qualified-certificate platform is used by businesses, public administrations and sensitive services across Europe. Thales subsequently confirmed the incident and attributed it to an outsourced service, making this a third-party/supply-chain style exposure rather than a direct compromise of the group's core infrastructure.

The exposed dataset included:

• Full names (first and last)
• Email addresses
• Phone numbers
• Associated organisations
• User roles and privileges (e.g. SIGNER, WATCHER, GDPR)
• Directory information and account statuses

A Thales spokesperson said the company was aware of the forum claims, stated that based on currently available information the leak had no operational impact on the group or its customers, notified France's data-protection regulator CNIL, and opened an investigation. At the time of reporting the exact origin and full authenticity of the database had not been independently confirmed; the principal risk highlighted was the use of the exposed contact and role data for targeted phishing and social-engineering campaigns.