Incidents from
Home medical equipment provider AdaptHealth disclosed a material cybersecurity incident in which a social-engineering attack on a third-party contractor let a threat actor into its cloud systems and reach patient personal and health information.
Medical device maker Medtronic began notifying roughly 3.8 million people that their personal data was exposed when the ShinyHunters extortion group accessed its corporate IT systems in April 2026.
The U.S. Department of Homeland Security confirmed that hackers breached the Homeland Security Information Network, an unclassified platform used to share sensitive information with federal, state, local and private-sector partners.
Kubota North America said an unauthorised party had month-long access to its network in early 2026, reaching HR files with the personal data of employees and dependents.
Aflac disclosed that attackers who breached its Japanese subsidiary's policyholder portal exfiltrated the personal information of roughly 4.38 million customers and insurance agents.
Japanese beverage group Sapporo Holdings disclosed suspected unauthorised access at its overseas subsidiaries Pokka in Singapore and Sleeman Breweries in Canada, shutting down affected systems to investigate.
Nissan's Americas operations disclosed that attackers exploiting a zero-day in Oracle PeopleSoft accessed sensitive data belonging to current and former employees in the United States, Canada, Mexico and Brazil.
The fast-growing extortion group TheGentlemen added German naval-defense electronics manufacturer Atlas Elektronik to its dark-web leak site on 28 June 2026, claiming a double-extortion attack dated to around 25 June, though the TKMS subsidiary had not publicly confirmed any breach.
Attackers compromised a third-party frontend vendor and injected malicious JavaScript into Polymarket's website, tricking users into approving fraudulent transactions and draining about $3 million.
Attackers began actively exploiting a critical unauthenticated server-side request forgery flaw in Cisco Unified Communications Manager, tracked as CVE-2026-20230, using the WebDialer service to write files and drop JSP webshells on enterprise telephony servers.
A flaw in third-party software let attackers breach the shared email platform KDDI operates for six Japanese ISPs, potentially exposing up to 14.22 million email addresses and passwords.
Indian automaker Bajaj Auto disclosed that a ransomware attack detected on the morning of 23 June 2026 affected systems at the company and its technology subsidiary, prompting containment measures and regulatory filings with CERT-In and SEBI.
The National Association of Insurance Commissioners disclosed on 23 June 2026 that attackers exploited an Oracle PeopleSoft zero-day to access part of its environment, and by 25 June the extortion group ShinyHunters had published the stolen data online, claiming more than 3.1 terabytes.
Xsolis, a US healthcare AI vendor, disclosed that a January phishing attack exposed the personal and protected health information of nearly 1.4 million people.
The Qilin ransomware group publicly claimed a June cyberattack on the Central Bank of Libya, threatening to leak stolen data after the bank said the intrusion touched a limited number of systems.
Japanese motor and electronics giant Nidec confirmed a ransomware attack on its Taiwanese subsidiary Nidec Chaun Choung Technology, after which the Blackfield gang claimed the breach and demanded a $2 million ransom.
Tata Electronics confirmed a cyberattack after data-extortion group World Leaks published over 200,000 stolen files, including documents researchers say reference Apple and Tesla.
Attackers used a customer account to exploit a system vulnerability at Canadian utility London Hydro, potentially accessing the names, contact details and account information of other customers.
A dormant API credential let attackers compromise competitive-intelligence platform Klue and harvest OAuth tokens for customers' connected apps, exfiltrating Salesforce records from firms including Huntress and Recorded Future in a supply-chain attack later tied to the Icarus extortion group.
Michigan's largest federally qualified health center, Cherry Health, posted a preliminary breach notice on 18 June 2026 after suspicious network activity detected in April triggered a days-long outage and the copying of patient and staff data, including Social Security numbers.
Nintendo of America confirmed that threat actors stole internal employee survey data from TinyPulse, a third-party HR engagement platform it used, after the SHADOWBYT3$ group claimed to have exfiltrated about 859 MB of data and demanded a US$2 million ransom — while stressing that Nintendo's own systems and customer data were not affected.
A breach at the third-party vendor that processes Texas hunting and fishing licence sales exposed the driver's licence numbers, passport numbers and contact details of more than three million Texans, though the state said Social Security numbers and financial data were not taken.
Imaging and materials company Eastman Kodak confirmed that an unauthorised third party temporarily accessed a limited amount of company data, after the ShinyHunters extortion gang listed Kodak on its dark-web leak site and claimed to hold more than 2.2 million records of customer and internal corporate data.
A dataset dubbed FortiBleed exposed valid Fortinet FortiGate VPN credentials — including plaintext passwords — for 73,932 firewall URLs across 194 countries, the product of a Russian-speaking crew that reused passwords from earlier breaches and infostealer logs rather than any new Fortinet vulnerability.
A hijacked contributor account was used to republish 144 packages in the popular @mastra AI-agent npm scope with a malicious typosquatted dependency, easy-day-js, that pulled down a cross-platform remote-access trojan and cryptocurrency stealer onto any developer machine or build system that installed them.
The ShinyHunters extortion gang published data it claims to have stolen from Madison Square Garden Sports — owner of the New York Knicks and Rangers — after the company missed a ransom deadline.
Google's Threat Intelligence Group disclosed that PRC-nexus actor UNC6508 spent more than a year inside U.S. and Canadian medical, academic and military-health research environments, compromising legacy REDCap servers, deploying custom INFINITERED malware and abusing Google Workspace email compliance rules to silently exfiltrate research and defense data.
The extortion group ShinyHunters claimed it stole roughly 297GB of payroll, HR and financial records belonging to more than 10,000 current and former Council of Europe staff by exploiting the Oracle PeopleSoft zero-day CVE-2026-35273, prompting the intergovernmental body to investigate.
A cyberattack against the shared communications infrastructure used by Bank Melli, Bank Saderat, Bank Tejarat and the Export Development Bank of Iran knocked ATMs, point-of-sale terminals and online banking offline, though officials said no customer data was accessed.
Attackers stole a CDN API key from Awesome Motive and tampered with JavaScript served to the OptinMonster, TrustPulse and PushEngage WordPress plugins, silently creating rogue administrator accounts and planting backdoors on sites whose logged-in admins loaded the malicious code.
Socket's Threat Research Team uncovered a coordinated family of 152 new-tab 'live wallpaper' Chrome extensions, spread across 38 publisher accounts and three brands, that secretly logged user telemetry and laundered extension-generated visits into fake Google organic search traffic despite declaring they collected no data.
Sonatype researchers uncovered 'Atomic Arch,' a supply-chain campaign in which attackers adopted hundreds of orphaned Arch User Repository packages and rewrote their build scripts to install a malicious npm package that drops a Linux credential stealer with optional eBPF rootkit capabilities.
Danish pharmaceutical giant Novo Nordisk disclosed that attackers copied pseudonymised patient information from some of its clinical trials out of its internal IT systems, prompting it to take certain systems offline while it investigates.
The University of Nottingham confirmed a cyber incident after the ShinyHunters extortion group claimed to have stolen around 40 GB of data from its student-records system, exposing roughly 455,000 email addresses along with names, passport numbers, and fee-payment details.
The extortion group FulcrumSec claimed it stole roughly 4.8 terabytes of data from Singapore-based Global Schools Foundation after exploiting database credentials left unchanged since a 2022 breach, leaking 33,088 passport numbers belonging to children and parents and around 9.4 million internal messages when ransom negotiations collapsed.
Ivanti patched a maximum-severity unauthenticated command-injection flaw in its Sentry mobile gateway that gives attackers root-level remote code execution, and within days real-world exploitation followed a public proof-of-concept, prompting CISA to add it to its Known Exploited Vulnerabilities catalog.
Researchers disclosed a Microsoft Defender privilege-escalation zero-day dubbed RoguePlanet (CVE-2026-47281) that abuses a race condition to redirect a SYSTEM-level file operation and hand a local attacker full SYSTEM access on fully updated Windows machines.
Oracle issued an emergency out-of-band alert after the ShinyHunters crew exploited a critical unauthenticated remote-code-execution zero-day in PeopleSoft PeopleTools to steal data from more than 100 organisations, most of them universities.
Google shipped an emergency Chrome update fixing CVE-2026-11645, a high-severity out-of-bounds memory flaw in the V8 engine that lets a crafted web page run arbitrary code and for which an exploit already exists in the wild.
ServiceNow disclosed that a misconfigured, unauthenticated REST API endpoint allowed actors to query data from hosted customer instances, an issue the company patched on 5 June but did not publish a (login-gated) advisory for until days later.
French authorities confirmed that an attacker hijacked a Tchap user account to access public chat rooms on the French state's secure messaging platform, with the intruder claiming to have scraped tens of thousands of accounts and hundreds of thousands of messages.
Check Point disclosed that attackers, including a Qilin ransomware affiliate, were actively exploiting a critical authentication-bypass zero-day (CVE-2026-50751) in its Remote Access and Mobile Access VPN products to log in without a valid password.
Attackers abused a verification flaw in Meta's AI-assisted Instagram account-recovery tool, High Touch Support, to trigger password resets and hijack 20,225 accounts before Meta detected and disabled the tool.
After negotiations stalled, the ShinyHunters extortion crew published data it claimed to have stolen from Baker Distributing's Salesforce and SharePoint systems, exposing more than 100,000 customer email addresses and contact records.
Cisco warned that an unpatched high-severity zero-day in Catalyst SD-WAN Manager (CVE-2026-20245) was being actively exploited to execute arbitrary commands and escalate to root, after Mandiant reported a limited number of real-world attacks.
A self-replicating supply-chain worm dubbed Miasma compromised 73 repositories across four Microsoft GitHub organisations, planting configuration files that harvested cloud and developer credentials when the projects were opened in AI coding agents such as Claude Code and Cursor.
Researchers disclosed IronWorm, a Rust-based, self-propagating infostealer that compromised 36 npm packages, stealing developer and CI secrets and republishing trojanized packages using stolen npm publishing credentials.
Dental benefits administrator DentaQuest confirmed a network breach after the extortion group ShinyHunters leaked roughly 234 GB of stolen data, exposing personal, identity, and health-insurance information tied to about 2.6 million accounts.
Google's June 2026 Android security update fixed 124 vulnerabilities, including CVE-2025-48595, an actively exploited integer-overflow flaw in the Android Framework that lets a local attacker escalate privileges without user interaction.
The UN World Food Programme disclosed that attackers gained unauthorized access to its self-registration application for Palestine, exposing names, ID and phone numbers, and location data for roughly 600,000 households in Gaza in what may be the largest known breach of humanitarian beneficiary data.
In May 2026, the GTA V and CS2 cheat service Atlas Menu suffered a data breach. An attacker claimed to have gained access to all Atlas systems and published the service's database to a public GitHub repository.
In May 2026, the corporate travel management company BCD Travel was claimed as a victim of the ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from BCD was subsequently published publicly in early June and contained 396k unique email addresses.
In late May 2026, a B2B commercial database attributed to French organic-food distributor Nature & Cie surfaced on a cybercriminal forum, exposing roughly 5,635 stores, over 1,500 professional contacts and around 1,500 sales-visit reports covering Biocoop, Naturalia and La Vie Claire partners.
On 22 May 2026, the town hall of Eyguières (Bouches-du-Rhône, ~7,000 inhabitants) was hit by a Qilin ransomware attack that took down its municipal IT systems and put residents' administrative and personal data at risk of compromise.
On 24 May 2026, the 4-star campsite Les Embruns d'Oléron in Le Château-d'Oléron, France, was hit by a data breach exposing some 39 GB of internal files, including the personal and booking details of at least 1,832 holidaymakers from 2024-2026 reservations.
The Optic 2000 group, one of the leading networks of opticians in France, appears in a data leak published on a cybercrime forum. The
On 23 May 2026, French digital health insurer Alan warned members that a cyberattack on its third-party claims processor Almerys had exposed their personal data — names, dates of birth, social security numbers and insurance contract details — though payment, password and health data were spared.
On 23 May 2026, AVEA Vacances, a French association organising educational stays and holiday camps for children and teenagers, was named in a forum leak of roughly 46,000 records (128 MB), including an 18,140-line file of postal-worker and CSE data plus booking and accounting documents.
On 23 May 2026, French holiday-camp association Avea Vacances was named by the threat actor ChimeraZ, who published roughly 46,000 records (128 MB) on a cybercrime forum, including stay-organisation documents and a file of more than 18,000 La Poste employees' details.
Camping-Car Plus, a French e-commerce retailer of motorhome and camper-van accessories, notified customers in May 2026 of a data breach exposing names, postal and email addresses, phone numbers and account login credentials including passwords; no banking data was affected.
In May 2026, the telecommunications company Charter Communications (the parent company behind the consumer broadband and cable brand Spectrum) was named by the ShinyHunters group in a "pay or leak" extortion campaign.
A data leak targeting Delko, a French network of garages and car maintenance centres, is currently being claimed by the cybercriminal group LAPSUS$, known for its extortion operations…
The French high-tech refurbishment specialist Largo informs its customers that it was the victim of a security incident that affected part of
In May 2026, French third-party health-payment operator Almerys disclosed a breach after a database of more than 44 million records — including 15.4 million unique social security numbers, names, birthdates and insurance details — was offered for sale on a cybercrime forum.
On 22 May 2026, a database holding the personal records of roughly 5.9 million customers of French optical chain Atol Mon Opticien was put up for sale on a cybercrime forum, exposing names, birthdates, emails, phone numbers and postal addresses.
On 22 May 2026, a database allegedly holding 5,924,215 customer records from the French optician cooperative Atol was put up for sale on a cybercrime forum, exposing names, birth dates, postal addresses, emails and phone numbers.
On 22 May 2026, a database holding the records of about 218,000 Auchan Optique customers — names, dates of birth, postal addresses, phone numbers and account identifiers — was put up for sale on a cybercrime forum, part of a coordinated wave of leaks hitting French opticians.
On 22 May 2026, a database attributed to French eyewear retailer Jimmy Fairly was put up for sale on a cybercrime forum, exposing the personal details of more than 357,000 customers, including names, full postal addresses, emails and dates of birth.
In May 2026, the Haute-Garonne departmental digital media library network (media31.mediatheques.fr) confirmed an intrusion after the threat actor AplaGroup exploited critical vulnerabilities and extracted user-account data on roughly 765 people.
Disclosed around 22 May 2026, the Haute-Garonne departmental media library network (Média31) was breached via exploited website vulnerabilities, exposing data on roughly 765 users including names, emails, dates of birth, cities and login details.
On 22 May 2026, French professional-training provider Move Up Formation (moveup-formation.fr) was listed on a cybercrime forum, where attackers claimed to have stolen its full SQL database, customer records, the site's entire source code and Stripe administrator access.
Nemea Groupe, a French operator of student residences, tourist residences and apart'hotels, confirmed a data breach affecting rental applicants after attacker ChimeraZ exfiltrated a database covering about 12,590 individuals, exposing identity, contact, banking and scanned ID documents.
A threat actor put a database from ATOA — a French real-estate tokenization and fractional-investment fintech — up for sale on a dark web forum, exposing roughly 23,685 user and financial records plus 326 full KYC archives containing passports, ID cards and banking details.
On 21 May 2026, McDonald's France confirmed a credential-stuffing campaign that hijacked customer McDo+ loyalty accounts, with fraudsters draining accumulated points for free orders; no banking data was affected and the company launched a mass password reset.
GitHub, the development platform used by millions of developers worldwide, confirmed having been the victim of a cyberattack that
On 19 May 2026 a threat actor known as ChimeraZ claimed to have leaked a database of French holiday-rental operator Lagrange Vacances, allegedly exposing booking records for more than 44,000 holidaymakers, reportedly via an IDOR vulnerability.
In May 2026, Maeva — the holiday-rental brand of Pierre & Vacances-Center Parcs — disclosed a breach in which an attacker scraped up to ten years of booking data, exposing names, dates of birth, phone numbers and stay details for around 4.5 million customers across 1.6 million reservations.
The Titan ransomware group claimed a double-extortion attack on Groupe CRIT's Tunisian subsidiary CRIT Tunisie, leaking payroll and administrative records, financial files and scanned identity documents and passports belonging to workers and employees.
On 18 May 2026, MediaVacances, a French peer-to-peer vacation-rental platform, had a database of roughly 256,000 customer invoices spanning 2005 to 2026 published on a cybercriminal forum, exposing names, addresses, payment details and listing data.
On 17 May 2026, the French rural-tourism rental network Gîtes de France disclosed a data leak exposing booking records for 389,129 customers — names, contact details, postal addresses and stay details — taken via fraudulent access tied to a shared IT provider.
Transitions Pro Centre-Val de Loire, the regional body that funds and supports employee career-retraining projects, was hit by the Prinz Eugen ransomware group, which claimed to have exfiltrated and encrypted hundreds of gigabytes of HR, financial and personal data and threatened to publish it.
On 15 May 2026, more than 25 GB of internal data from French document-management platform Djaboo (djaboo.com) was published on a cybercriminal forum, including a full database dump and records for 12,378 CRM accounts, 6,372 client companies and 13,578 individuals.
In May 2026, French tourism group Pierre & Vacances-Center Parcs disclosed a breach of its maeva-owned 'La France du Nord au Sud' platform, exposing personal data tied to about 1.6 million reservations and up to 4.5 million customers, including names, dates of birth, phone numbers and stay details.
OpenAI confirmed in May 2026 that two employee devices were compromised through the TanStack npm supply-chain attack, allowing attackers to exfiltrate limited authentication credentials from internal code repositories that contained its software signing certificates.
Pierre & Vacances-Center Parcs customers are affected by a data leak confirmed by the group, linked to the La France du Nord au Sud booking platform, used in particular for…
On 14 May 2026, a threat actor known as ChimeraZ claimed a leak of around 1,600 researcher and staff profiles from the Collège de France, along with hundreds of megabytes of internal files pulled from a Nextcloud file-sharing instance.
On 14 May 2026, threat actor ChimeraZ leaked data from EFC Formation (École Française de Comptabilité), publishing a 1.3 GB archive on about 49,000 students and offering a second 41 GB set of 60,683 administrative and banking PDFs for sale.
On 13 May 2026, a threat actor using the alias lazasec123 advertised a database of roughly 2.3 million profiles tied to French motorcycle licences and FFMOTO.org, exposing names, dates of birth, postal addresses, emails and phone numbers, offered for sale at 150 euros.
On 14 May 2026, the cybercriminal ChimeraZ published roughly 11,000 documents (about 8.6 MB of JSON and PDF files) attributed to UPPCTSC (Union-prof.asso.fr), exposing training-center conventions, institution details, professional email addresses and timestamped download logs.
The Anubis ransomware group claims to have compromised the systems of A.R.Ge.Co, a French company specializing in accounting services and
On 13 May 2026, a threat actor known as ChimeraZ published on a cybercrime forum a roughly 1 MB JSON file said to contain about 5,500 customer profiles from French online computer-hardware retailer Akitatek, exposing names, postal addresses and phone numbers.
The Nitrogen ransomware group claimed on its dark-web leak site that it had stolen over 11 million files from Foxconn's North American facilities, including confidential information belonging to customers Apple, Dell, Google, Intel, Nvidia, and Sony. Foxconn said affected factories were resuming normal production.
The Qilin ransomware group claims to have compromised the systems of Le Domaine des Tournels, an establishment located in the Gulf of Saint-Tropez. At this
A hacker going by the name TeamPCP claims to hold a significant quantity of internal data belonging to Mistral AI, the French startup
Carmaker Škoda, a subsidiary of the Volkswagen group, has confirmed it was the victim of an intrusion targeting its online store. According to
On 13 May 2026, a database of 256,319 records attributed to French last-mile delivery platform Woop (woopit.fr) was put up for sale on a cybercriminal forum, exposing names, postal addresses, phone numbers, email addresses, birth dates and banking details.
Best Western parent BWH Hotels disclosed in May 2026 that an unauthorised third party had access to a guest-reservation web application from 14 October 2025 to 22 April 2026, exposing names, emails, phone numbers, postal addresses and booking details; payment data was not affected.
On 11 May 2026, a dataset attributed to CalendrIDEL, a French scheduling platform for self-employed nurses, was posted on a cybercrime forum, exposing the email addresses, mobile numbers, postal codes and profile names of roughly 1,400 nurses.
In May 2026, an actor using the alias lazasec claimed to have breached CARMF, France's pension and benefits fund for self-employed doctors, leaking a database of up to 2.4 million records with names, contributor codes, postal addresses and last-declaration dates; CARMF said the exposed data was public and non-sensitive.
On 11 May 2026, French renewable-energy cooperative Enercoop suffered a security incident in which email addresses tied to customer, prospect and member accounts were compromised and abused to send fraudulent phishing messages impersonating its customer service.
The hacker ChimeraZ claims to hold data linked to La Boîte Immo, a French company specialized in software and digital services for
On 12 May 2026, a threat actor known as ChimeraZ published an 85 MB JSON file with roughly 6,410 user profiles from a digital-trust platform tied to LuxTrust and Thales, exposing names, emails, phone numbers, organizations and account roles.
In May 2026, a database attributed to French dermo-cosmetics brand Nuhanciam surfaced on a cybercrime forum, exposing more than 156,000 customer records including names, emails, dates of birth, postal addresses, phone numbers and hashed passwords.
The town of Roubaix disclosed a data breach on its Kiosque famille school-services platform after two user accounts were compromised, exposing identity and schooling details of 165 enrolled children and their families; no banking data was affected.
On 12 May 2026, a threat actor known as ChimeraZ published an 85 MB JSON file with roughly 6,400 user profiles tied to French defence group Thales; the data originated from LuxTrust, an outsourced e-signature provider, and exposed names, emails, phone numbers, organisations and account roles.
On May 10, 2026, a database of 187,927 records attributed to Paris niche perfumery Kams Paris was put up for sale on a cybercriminal forum, exposing customers' names, postal addresses, phone numbers, dates of birth and IBANs.
On 11 May 2026, Once For All disclosed unauthorized access to its Actradis B2B compliance platform, exposing professional contact data (names, professional emails, phone and contact details); a leaked database circulating since early May reportedly held about 305,000 records.
In May 2026, France's La France Insoumise party had data from its Action Populaire activist platform stolen and posted on a hacking forum, exposing some 120,000 email addresses, 20,000 phone numbers, postal addresses and member activity spanning 2017-2026.
On 9 May 2026, the threat actor AplaGroup claimed an intrusion into Média31, the online media-library platform of the Haute-Garonne departmental libraries (France), exposing data on roughly 765 users; the breach was confirmed on 21 May 2026.
A database tied to Monservicederemplacement.fr, the platform run by France's agricultural replacement service (Service de Remplacement France), surfaced online in May 2026, exposing 213,477 records on about 184,724 people, including names, contact details, dates of birth and social security numbers.
On 8 May 2026, French e-cigarette retailer Arsène Valentin disclosed that malicious code injected into its e-commerce website had exposed customer personal data — names, emails, postal addresses, phone numbers, dates of birth and order history; the breach was reported to the CNIL.
On 8 May 2026, French bakery chain Boulangerie Ange confirmed a data breach exposing the names, phone numbers and cities of around 812,000 customers registered on its digital services, after an exposed authentication token allowed API access to its database.
In May 2026, the BravoX ransomware group claimed a double-extortion attack on Soprolux, a French food distributor serving restaurants and professional clients, publishing banking documents, SEPA mandates, IBAN/RIB details and customer and supplier records to pressure the company.
In early May 2026, West Pharmaceutical's plant at Le Nouvion-en-Thiérache (Aisne, France), which employs around 770 people making rubber components for syringes and medical devices, was hit by a cyberattack that halted production for roughly two weeks; no data exfiltration was confirmed.
In early May 2026, the MedusaLocker ransomware gang listed the Académie de Montpellier / CSJM — a French public-school network around Béziers — on its leak site, claiming to have exfiltrated administrative documents and credentials, with reported exposure of 309 staff and 6,915 user accounts.
On 7 May 2026, a hacker using the alias 'fuzzeddffmepg' claimed to have breached Action Populaire, the activist platform of France's La France Insoumise party, exposing roughly 120,000 email addresses, 20,000 phone numbers, private messages and payment data spanning 2017-2026.
In May 2026, Bilov — operator of the French Boulangeries Ange bakery chain — disclosed a data breach exposing the personal details (name, city, phone number) of around 812,000 customers after an active authentication token allowed unauthorized API access.
On May 6, 2026, a threat actor using the alias Lagui posted a database of 367,462 Leroy Merlin France loyalty-program customers — names, dates of birth, contact details, postal addresses and account data — said to have been harvested by automated scraping of the Leroy&moi platform.
French domain registrar BookMyName detected a security incident on 5 May 2026 in which an attacker exploited a vulnerability to fraudulently alter domain contact data, exposing logins, names, emails, phone numbers and postal addresses of some customers.
Cetelem, the consumer-credit brand of BNP Paribas Personal Finance, confirmed a cyberattack on 20 April 2026 that exposed the email addresses of several hundred thousand customers; the company says no passwords, banking or payment data were compromised.
In May 2026, the real estate services firm Cushman & Wakefield was the target of a "pay or leak" extortion campaign by the ShinyHunters group. Following the threat, the group publicly published data they alleged had been obtained from the firm, consisting mostly of C&W email addresses along with…
On 5 May 2026, the SpaceBears ransomware group listed French industrial-equipment manufacturer Erla Technologies SAS on its leak site, claiming to have stolen employee and client personal data, financial documents and project files — including documentation tied to a French army client.
A database attributed to Newdeal Institut, a language training centre, has been published on a cybercrime forum by a hacker posing as
On 3 May 2026 the town of Quiberon (Morbihan, France) was hit by a Qilin ransomware attack that encrypted part of its IT systems and exfiltrated personal data; the city refused the ransom and began a gradual, secured rebuild of its infrastructure.
On 4 May 2026, Auto École du Lys — a French driving school in Dammarie-les-Lys — was hit by a confirmed data leak exposing files on its 220 candidates, including very recent records with driving-exam dates running up to April 2026.
Auto École du Moulin, a driving school in La Rochelle, France, suffered a data leak disclosed on 4 May 2026 that exposed personal records of 428 candidates, including their driving-licence examination history.
On 4 May 2026, a confirmed data leak at École de conduite Vincent, a driving school in Ancenis-Saint-Géréon (France), exposed the records of around 1,556 candidates, including names, dates of birth, emails, NEPH dossier numbers and detailed driving-exam histories.
On 4 May 2026, a threat actor using the alias Spirigatito claimed to publish roughly 55 GB attributed to France's École de Psychologues Praticiens (Psycho-Prat), including a student database, ID documents, IBANs and the site's full source code.
On 4 May 2026, the threat actor DumpsecV2 claimed a breach of French automotive dealership group Groupe GCA, exposing data on roughly 65,000 customers and 2,500 employees, including names, contact details and vehicle information such as registration numbers and VINs.
Customers of Groupe GCA, a network of car dealerships, are reportedly affected by a claimed leak impacting nearly 67,500 people, according to the claim. The Dumpsec collective states…
In May 2026 a threat actor using the alias lowiq advertised a database of roughly 1,223,520 records attributed to French running-gear e-tailer i-Run, but the company investigated and determined the data did not originate from its own systems.
On 4 May 2026 a hacker using the alias Lagui published a database of roughly 96,000 La Redoute customers — names, postal addresses, phone numbers, emails and order/delivery histories — that the retailer traced to a January 2026 breach at its logistics partner Relais Colis.
The hacker ChimeraZ has published a database attributed to Smallable.com, an e-commerce site specialising in children's and family products. The
On 3 May 2026, a threat actor using the alias Lagui published a database attributed to Actradis, a French enterprise compliance-document platform, exposing roughly 82,611 client records and 222,473 internal tracking entries.
The Ambroise Paré clinic in Beuvry says it was the victim of a cybersecurity incident on 21 April 2026, according to a communication published on 30
In April 2026 the French Basketball Federation (FFBB) suffered a data breach after an attacker abused a compromised user account in its licensee-management tool, exposing identity and contact details of up to ~2 million licensees and ~900,000 legal representatives.
A December 2025 cyberattack on Eurail B.V., operator of the Interrail and Eurail rail passes, exposed personal data of roughly 308,000 travellers — including names, contact details, dates of birth and passport numbers — which by 2026 was being sold on the dark web.
A threat actor known as Lagui published a database attributed to French recruitment firm Profil Search containing roughly 100,642 candidate records, exposing names, emails, phone numbers, postal addresses and professional details.
A hacker using the alias Cybernox claims to be putting up for sale a database attributed to the French Ministry of Sports, Youth and
On 2 May 2026, a database attributed to French promotional-items retailer ObjetRama.fr was published by a hacker using the alias ChimeraZ, exposing roughly 209,000 order and billing records tied to nearly 80,000 distinct customers.
France's Agence du Service Civique disclosed a personal-data breach affecting its volunteer-host training platform, after a database of contacts at accredited organisations — names, emails, postal addresses, phone numbers and accreditation numbers — was published on a cybercrime forum.
On 1 May 2026, a hacker claimed to have breached Faco Paris, a private higher education institution, and released a roughly 12 GB archive holding over 11,000 sensitive documents, 27,000+ source code files, identity papers, IBANs and student data.
ShinyHunters exploited Canvas's Free-For-Teacher account programme to exfiltrate 3.65 TB of data spanning approximately 275 million users across nearly 9,000 schools — names, email addresses, student IDs, and some private messages between students and teachers. Instructure reportedly paid the ransom and the data was destroyed.
On 1 May 2026, a database holding 543,124 customer records attributed to boutique-jourdefete.com — the online store of French party-supplies retailer Jour de Fête — surfaced on a cybercrime forum, exposing names, emails, postal addresses, phone numbers and login tokens.
On 1 May 2026, French pizzeria chain La Pizza de Nico was named in an unverified breach claim alleging that a database of 67,767 customers had been published, exposing personal contact details of nearly 68,000 people.
On 1 May 2026, a database attributed to French design e-commerce site Madeindesign.com was posted on a cybercrime forum by a threat actor known as ChimeraZ, exposing around 464,000 customer accounts in a roughly 205 MB JSON dataset; the company has not formally confirmed the breach.
A database attributed to ADEMI, an agricultural weighing system, is currently circulating online, exposing sensitive information related to
On 30 April 2026, French video game studio Ankama (Dofus, Wakfu) disclosed a cyberattack that gave attackers unauthorized access to account data — names, emails, cities, IP addresses, order history and partial card numbers — affecting hundreds of thousands of players.
A database attributed to AQUAES, a directory of French environmental consulting and engineering firms, surfaced online on 30 April 2026, exposing firm names, manager names, full postal addresses, phone numbers, email addresses, websites and GPS coordinates.
Disclosed on 30 April 2026, a data leak at French smart-home manufacturer Delta Dore exposed personal data of at least 374 people registered on its professional training portal, formation-pro.deltadore.fr, prompting affected-user notifications.
In April 2026, the gaming community Reborn Gaming suffered a data breach due to a vulnerability in cPanel and WebHost Manager (WHM). The breach exposed 126 unique email addresses along with IP addresses and Steam IDs. Reborn Gaming self-submitted the data to Have I Been Pwned.
On 30 April 2026 a hacker claimed to be selling a 443,000-record database tied to French online savings platform Yomoni, exposing names, contact details, dates of birth and tax-residency data; Yomoni disputed the leak after investigation.
On 29 April 2026, French media-criticism association Acrimed disclosed a cyberattack on its online shop that exposed customers' email addresses, encrypted passwords and order history; names, postal addresses, phone numbers and banking details were said to be unaffected.
Aréli, a Lille-based social-housing association, disclosed via a letter to partner organizations that a 12 January 2026 cyberattack exposed partner contact details and bank account information (RIB), affecting less than 2% of the data held on its servers.
On 29 April 2026, a threat actor published a partial database from toucan.campusfrance.org, the online application platform of France's public higher-education agency Campus France, exposing roughly 18,000 international student application files (about 430 MB of JSON) including names, emails, and chosen programs.
On 29 April 2026, the City of Saint-Étienne and Saint-Étienne Métropole disclosed a security incident at their third-party ticketing provider, prompting the precautionary deactivation of user account passwords and a forced reset for online ticketing customers.
The MyPiscine e-commerce site informs its customers that it was hit by an intrusion on 23 April 2026, resulting in unauthorised access to certain
In April 2026, the ShinyHunters extortion group listed Vimeo on their extortion portal as part of their "pay or leak" campaign. They subsequently published hundreds of gigabytes of data, predominantly consisting of video titles, technical data and metadata.
A threat actor leaked a database extracted from Bordeaux Métropole's tourist tax portal, exposing the names, emails, phone numbers and property addresses of around 11,000 holiday-rental declarants; the metropolitan authority later confirmed the breach.
On 27 April 2026, the Qilin ransomware group listed Exclusive Networks — the France-headquartered global cybersecurity and IT distributor — on its leak site, threatening to publish stolen data unless the company entered negotiations; the scope remained unconfirmed.
On 27 April 2026, French eco-friendly online eyewear brand L'Opticienne Verte was named in an unverified data-leak claim involving 13,039 customer records — names, emails, phone numbers, postal addresses and dates of birth; the company disputes any intrusion.
On 27 April 2026, a group calling itself LunarisSec claimed to have breached Université de Toulouse and leaked a database of academic profiles—names, emails, phone numbers and research details for faculty, doctoral candidates and staff—though the university issued no official confirmation.
In April 2026, data allegedly obtained from CTT, Portugal's national postal service, was posted to a public hacking forum. The data included 468k unique email addresses along with names, phone numbers and parcel tracking numbers which can be used to retrieve the tracking history of the parcel.
On 26 April 2026, a database of 1,154 user profiles tied to the French Ministry of Ecological Transition was published online, exposing staff names, professional @developpement-durable.gouv.fr email addresses, login dates and group memberships.
On 26 April 2026, the hacker Angel_Batista republished a dataset on about 59,000 French National Gendarmerie members — names, phone numbers, personal and professional emails, postings and account details — scraped in 2025 from the inter-ministerial Resana platform.
On 26 April 2026, a threat actor known as ChimeraZ published online the database of Sejourneur.com, a French seasonal-rental management platform, exposing around 53,000 bookings, over 7,000 PDF invoices and personal data on more than 46,000 people.
On 25 April 2026, a hacker using the alias ChimeraZ claimed to have stolen and published the database of French student-housing platform Adele.org, exposing roughly 261,000 rental application files (~560 MB) containing scanned ID cards, passports, health-insurance cards, bank details and tax documents.
On 25 April 2026, a confirmed data leak exposed customer personal data — names, email addresses, phone numbers, postal addresses and hashed passwords — from French ceramic and tile decoration retailer Céram Décor.
On 25 April 2026, IFprofs — the global social network for French-language teaching professionals run by the Institut français — had a database of roughly 90,000 member accounts published online by a threat actor known as ChimeraZ, exposing profile details and platform activity.
The Agence de services et de paiement (ASP), the public body responsible for paying out many state benefits, has confirmed a security incident that
ANFR, France's national frequency agency, disclosed that an intrusion into its Radiomaritime online service exposed the personal data — names, postal addresses, phone numbers, emails and dates of birth — of roughly 330,000 users; a sample was put up for sale online.
The Agence Nationale des Fréquences (ANFR), the public authority responsible for managing the radio spectrum in France, has been the victim of a cyberattack
On 24 April 2026 an unnamed hacker claimed on Telegram to have compromised the supervision infrastructure of STOR Solutions, a La Réunion datacenter operator, alleging access to internal monitoring consoles and to 120,000+ UPS units; the claims remain unverified.
In April 2026, French retail cooperative Système U disclosed a breach of its magasins-u.com loyalty portal in which attackers gained unauthorized access to customer accounts, exposing names, contact details and loyalty-card numbers but no banking data.
In April 2026, online training company Udemy was the victim of a “pay or leak” extortion attempt perpetrated by the ShinyHunters group. The data was subsequently leaked publicly and contained 1.4M unique email addresses belonging to customers and instructors.
On 23 April 2026, a threat actor using the alias 'undef' claimed to be selling a database from French electrostimulation fitness chain Bodyhit, exposing the personal and banking details of more than 218,000 customers, including over 42,000 IBANs.
Follow-up reporting on the April 2026 breach at France Titres (ANTS), France's secure-identity-document agency: beyond the officially confirmed ~11.7 million exposed accounts, the threat actor now claims access to roughly 600 million lines of data, including plaintext passwords, API and encryption keys, and source code.
On 23 April 2026, a threat actor claimed to have breached the internal website of La Mie Câline's bakery in Biscarrosse, France, leaking a local database of customer records along with administrator credentials on a cybercrime forum.
The French Ministry of Higher Education, Research and Space has revealed a security incident affecting the data of certain applicants
Insurance broker Wazari is informing its customers of a security incident linked to an external attack that affected a management and storage tool
On 22 April 2026, Dutch cosmetics and home-fragrance brand Rituals disclosed an unauthorised download of its loyalty membership database, exposing members' names, dates of birth, gender, postal and email addresses and phone numbers; no passwords or payment data were affected.
On 22 April 2026 the group LunarisSec claimed a data leak from France's Université Aix-Marseille, posting screenshots of internal user lists with names, institutional emails and profile data for students, doctoral candidates, interns and staff; the university cut its network and said systems and data integrity were preserved.
A hacker claims to have 6 GB of images related to several French nuclear power plants operated by EDF, following a claim published on a forum
In April 2026, the Coinbase Cartel extortion group listed French energy giant Engie on its dark web leak site, claiming to have stolen sensitive data and threatening to publish a full dump unless a ransom was paid; Engie did not publicly confirm the breach.
On 21 April 2026, a database holding around 6,700 unique profiles tied to French real estate network Ledil Immobilier was posted for download on a cybercriminal forum, exposing names, contact details, internal CRM records and property/transaction data.
In April 2026, French retail cooperative Magasins U notified loyalty-card holders that unauthorized access to its magasins-u.com customer area exposed personal data including names, contact details and loyalty-card numbers, though banking data was not affected.
On 21 April 2026, French medical-packaging manufacturer Sterimed was claimed by the Qilin ransomware group, which published internal files — technical documents, project data, HR records, IT-security material and system backups — on its dark-web leak site.
The Magasins U group (Super U) informs some customers that it has been the victim of an external and malicious cyberattack that led to unauthorised
In April 2026, home security firm ADT confirmed a data breach by ShinyHunters, which listed the company on its website as part of a "pay or leak" extortion attempt. The breach impacted 5.5M unique email addresses along with names, phone numbers and physical addresses.
In April 2026, the ultra-luxury hotel brand Aman was named by ShinyHunters as the target of a "pay or leak" extortion campaign, with the data allegedly obtained from their Salesforce CRM. The data was subsequently leaked publicly and contained over 200k unique email addresses.
France Titres (ANTS), the French government agency issuing secure identity documents, disclosed a breach of its moncompte.ants.gouv.fr portal via an IDOR API flaw; officials confirmed 11.7 million accounts exposed (names, dates of birth, emails, addresses), while a hacker claimed up to 19 million records.
In April 2026, Canada Life was the victim of a "pay or leak" extortion campaign by the ShinyHunters group. The group subsequently published the data which contained over 200k unique email addresses along with names, phone numbers, physical addresses and, in some cases, customer support tickets.
On 20 April 2026, the City'Pro Marionneau vocational and driving-training network was hit by a cyberattack claimed by the Qilin ransomware group, which published stolen files — trainee records, HR documents, and commercial data — on its leak site.
On 20 April 2026, French law firm Gueguen Avocats was listed on the Qilin ransomware leak site, which claimed to have exfiltrated thousands of files including internal emails, financial reports, a password spreadsheet, employee data and client case files.
In April 2026, the hacking collective ShinyHunters claimed to have obtained data from Pitney Bowes as part of a broader extortion campaign that also named several other organisations.
On 19 April 2026, the Algerian hacktivist group LunarisSec claimed to have extracted a user database from Université de Bourgogne, exposing names, email addresses and account activity details of students and staff; the scale was not disclosed and the university issued no confirmation.
On 19 April 2026, cloud platform Vercel (creator of Next.js) confirmed a security incident traced to a compromised third-party AI tool, exposing non-sensitive environment variables and a limited subset of customer accounts.
In April 2026, the notorious hacking collective ShinyHunters claimed they had obtained a substantial volume of data belonging to the Carnival cruise operator and attempted to extort the organisation to prevent the data from being leaked.
On 18 April 2026, the threat actor ChimeraZ claimed to have published a customer database stolen from Comptoir du Rêve, a Toulouse-based comics and manga bookseller, containing 42,606 records tied to 38,085 individuals.
On 18 April 2026, a hacker group claimed on a cybercrime forum to be selling 'Smart Card Middleware Desktop' software attributed to IN Groupe (formerly Imprimerie Nationale), the French state-owned maker of secure identity documents.
The online retailer JeuJouet.com informed its customers by email after a cyberattack affecting the Magento e-commerce platform, used by many
A global automated campaign exploiting an unauthenticated file-upload weakness in Magento defaced 7,500+ e-commerce sites across 15,000+ hostnames, dropping malicious files on stores tied to brands including Toyota, Fiat, Asus and FedEx.
On 18 April 2026 French toy and baby-goods brand Moulin Roty emailed customers to warn that a cyberattack on its shared Magento e-commerce platform may have exposed identity, contact, account-login, purchase-history and marketing data, though no compromise was confirmed and banking details were not affected.
On 17 April 2026, online manga retailer Bazar du Manga confirmed that customer identity and contact details had been extracted without authorisation from its database and were being used by a third party, Panda Manga, for unsolicited marketing; no payment data was affected.
On 17 April 2026, the French bookstore e-commerce site ComptoirDuReve.fr was reported to have suffered a data leak exposing a database of nearly 42,000 customers, including names, titles and full postal addresses usable for targeted fraud.
On 17 April 2026, France's Basketball Federation (FFBB) disclosed that fraudulent access to a user account let an attacker (alias HexDex) extract identity, contact and licence data on up to 1.9 million members and roughly 800,000 parents.
Filair, a French industrial metal-fabrication company, was hit by the Lamashtu extortion group, which exfiltrated and published nearly 50 years of internal archives — tens of thousands of files spanning CAD engineering data, financial records and HR documents.
Gauthier Tissus, a French manufacturer of technical woven and finished fabrics, was listed on the Lamashtu extortion group's leak site, which published roughly 54 GB (about 8,500 files spanning 1996–2026) of internal financial, HR, commercial and R&D data.
French online toy retailer JeuJouet.com warned customers in April 2026 that its Magento e-commerce platform was compromised in a mass exploitation campaign, potentially exposing names, email addresses, account credentials and order data; no banking details were affected.
The Clinique de l'Yvette in Longjumeau is reportedly targeted by a cyberattack, with data put online and administrator access claimed by a
On 16 April 2026, a threat actor known as ChimeraZ claimed to be distributing a roughly 6,600-record database stolen from ETAI (Infopro Digital Automotive), exposing French garages' business identifiers, contact details and hashed account credentials.
In April 2026, the DumpSec group claimed to have stolen roughly 150 GB of data from Assuréa, an auto-insurance broker in the Meilleurtaux group, exposing some 139,000 clients, contract records and 11,000+ documents containing IBANs.
On 15 April 2026, threat actor HexDex offered for sale a database stolen from French hotel chain Brit Hotel, exposing 682,662 loyalty-programme members along with emails, phone numbers, postal addresses and a decade of reservation history (2016–2026).
In April 2026, the American insurance holding company Kemper Corporation was named by the ShinyHunters ransomware group in a "pay or leak" extortion campaign.
On 15 April 2026 France's National Police (DGPN) confirmed that its e-campus online training platform, run by a third-party provider, was hacked in mid-March; the group HexDex claimed 176,317 agent profiles including names, professional emails, locations and login histories.
On 15 April 2026, Pompes Funèbres Musulmanes Toulouse, an Islamic funeral provider, suffered a data leak claimed by an actor known as "ntmpd" who posted a 1,178-record database dump plus working admin credentials on a hacker forum, exposing client and deceased records.
In April 2026, the fashion brand Zara was among a number of organisations targeted by the ShinyHunters extortion group as part of their "pay or leak" campaign.
In April 2026, the fintech software company Abrigo was targeted in a "pay or leak" extortion attempt by the ShinyHunters group. Shortly after, data allegedly taken from the company's Salesforce instance was published publicly and contained over 700k unique email addresses belonging to both Abrigo…
On 14 April 2026, the threat actor Lamashtu claimed to have stolen roughly 52.6 GB of data and about 41,000 files from France's wine appellations confederation CNAOC, spanning 1994-2025 and including financial, HR and governance records.
On 14 April 2026, a hacker known as HexDex claimed the theft and sale of personal data belonging to 598,154 members of Logis Hotels' ETIK loyalty program, with records spanning 2012 to 2026 and including identity, contact, billing and login details.
In April 2026, gym chain Basic-Fit disclosed that attackers breached its member check-in system, exposing the personal and banking details of roughly 1 million members across France, Belgium, Germany, Spain, Luxembourg and the Netherlands.
The online ticketing data of visitors to the Château royal de Blois / Maison de la Magie was exposed in the breach of its provider Vivaticket (Tickeasy), leaking names, email and postal addresses, dates of birth, phone and fax numbers and VAT numbers.
In April 2026, alumni of IAE Grenoble were exposed in a breach of AlumnForce, the third-party platform managing its alumni network; the stolen dataset spanned ~2.7M profiles across 49 French institutions and included names, contact details and full professional/education histories.
A security incident reportedly affected Booking.com, with unauthorised access to data related to customer reservations. According to initial
In April 2026, France's Ardèche department disclosed a breach in which an attacker exploited a flaw at an external service provider and exfiltrated roughly 26 GB across 88,000+ files of RSA welfare-beneficiary data spanning 2017-2026.
After the massive leak referencing EduConnect, a new alert is circulating around École Directe, a platform widely used in schools
The hacker ChimeraZ claims to have published a database linked to the Insei.fr site, containing sensitive personal information as well as
In April 2026, the commercial real estate brokerage firm Marcus & Millichap was named as one of multiple alleged victims of the ShinyHunters hacking and extortion group.
In April 2026, the luxury fashion e-commerce platform Mytheresa was listed as a victim of the ShinyHunters "pay or leak" extortion group. After the ransom deadline passed, the group publicly released the data which contained 84k unique email addresses.
In April 2026, a hacker using the alias Cybernox claimed to have compromised a Paris secondary school under the Académie de Paris, exposing data on more than 5,500 people — including 1,701 students (minors) and 3,811 guardians — with names, addresses, INE numbers, ID photos and guardians' IBANs.
The hacker Cybernox claims to hold a database linked to ADMR (Aide à Domicile en Milieu Rural), containing several thousand profiles. According to the
On 11 April 2026, a database described as a France-wide used-vehicle export covering 70,551 vehicles, along with the buyers and suppliers recorded against them, was put forward in a claimed but unverified data leak.
A hacker claims to hold a database tied to EduConnect, the official Ministry of Education system used to track schooling of
A threat actor on DarkForums claimed in April 2026 to have stolen the FranceVerif.fr database, exposing at least 3,204 unique accounts belonging to reviewers and merchants, including names, emails, phone numbers, postal addresses and business identifiers (SIRET/VAT).
A hacker known as HexDex claims to be selling a database containing more than 70,000 vehicles, along with detailed information about their
In April 2026, alumni data of Université Côte d'Azur was exposed as part of a breach of the AlumnForce platform, leaking names, contact details, education and detailed professional/career information for tens of thousands of graduates, within a wider 2.7-million-record leak across 49 institutions.
Around 10 April 2026, a threat actor put DB Telecom (Service Telecom) — a Marseille-based IP-telephony operator on the Orange/Or-Tel network — up for sale, leaking a database of roughly 41,470 customers and 2,835,372 records including names, contacts, plaintext passwords and internal emails.
EasyLounge customers are affected by a data leak confirmed by the company, after a cybersecurity incident communicated to the people concerned. The company, Hi-Fi and…
ENSAI Network alumni data was exposed in the April 2026 breach of its platform provider AlumnForce, which leaked some 2.7 million student and graduate profiles from 49 French institutions — including names, emails, phone numbers, locations, career history and education details — now offered for sale on cybercrime forums.
In April 2026, Lilagora — the University of Lille's alumni network — saw its members' data exposed in a breach of its third-party platform provider AlumnForce, part of a wider incident affecting 2.7 million profiles across 49 French institutions, with names, contact details and professional histories leaked.
In April 2026, education company McGraw Hill confirmed a data breach following an extortion attempt. Attributed to a Salesforce misconfiguration, the company stated the incident exposed "a limited set of data from a webpage hosted by Salesforce on its platform".
On 10 April 2026, French hi-fi and home-cinema retailer Son-Video.com (and sister brand EasyLounge) notified customers of a data leak following unauthorised access, exposing names, contact details, postal addresses and order history, though no banking data or passwords.
UPPA Alumni, the alumni network of the University of Pau et des Pays de l'Adour, confirmed its members' data was exposed in the April 2026 breach of its provider AlumnForce, leaking names, contacts, education and detailed professional profiles.
French champagne group Vranken-Pommery disclosed on 10 April 2026 that a ransomware attack on its external online-ticketing provider exposed personal data of visitors to its Reims tourist sites, including names, dates of birth, contact details and reservation records, though banking data was not affected.
Individuals who took the DCL (Diplôme de Compétence en Langue) would be affected, according to the claim, by the sale of a file containing the personal data of 93,061…
In April 2026 a threat actor known as HexDex advertised the sale of a database stolen from France's university sport federation (FFSU), exposing the identities, contact details and registration data of roughly 1.1 million students, licensees and staff.
In April 2026, 7-Eleven was the victim of a "pay or leak" extortion campaign by ShinyHunters, with the data later published that month. The incident exposed 185k unique email addresses, along with names, physical addresses, dates of birth and phone numbers.
On 8 April 2026, a database tied to France's Académie de Nice was found circulating online, exposing roughly 19,000 records on teachers and administrative staff, including names, professional emails, job assignments and workplace details.
French email-security provider Alinto left an unsecured Elasticsearch cluster exposing more than 40 million SMTP records (around 4.5 million unique addresses) — metadata for emails from L'Oréal, Renault, Carrefour, DHL and 14,000 French government accounts.
On 8 April 2026, the alumni network of the University of Strasbourg was exposed as part of a wider compromise of the AlumnForce platform, leaking members' names, contact details, education history and professional career data across 49 French institutions (~2.7M profiles in total).
On 8 April 2026, the French metal-grating manufacturer Diamond was listed on the Gunra ransomware group's leak site, which claimed to have exfiltrated confidential OneDrive and SharePoint documents covering projects, clients and internal operations.
France's DGFiP disclosed that an attacker, using a civil servant's usurped credentials, accessed the FICOBA national bank-account registry between late January and early April 2026, exposing IBAN/RIB details, names and addresses for about 1.2 million accounts.
Members of KFC France's Colonel Club loyalty program received an email informing them of a breach of their personal data. KFC France said in this message that the number…
In April 2026, the NSFW AI girlfriend platform My Lovely AI suffered a data breach that exposed over 100k users. The data included user-created prompts and links to the resulting AI-generated images, along with a small number of Discord and X usernames.
In early April 2026, Synergy, a French data-management and cloud-services provider, was reportedly hit by a ransomware attack involving unauthorised access to its systems and a probable threat to exfiltrated client data; the scale and attacker were not disclosed.
In April 2026, AlumnForce — the French SaaS platform that powers alumni networks for dozens of universities and grandes écoles — was hit by a data breach exposing roughly 2.7 million profiles, including names, emails, phone numbers and detailed career data, later put up for sale on criminal forums.
On 6 April 2026, the Akira ransomware group listed French aerospace connector manufacturer Gauthier Connectique (a Nicomatic company) on its leak site, threatening to publish 42 GB of exfiltrated data including employee ID documents, technical drawings, financial records and NDAs.
In April 2026, the commercial residential and ISP proxy network LegionProxy suffered a data breach. The incident exposed 10k email addresses, bcrypt password hashes, names and purchases.
On 6 April 2026, Bordeaux-based healthcare software publisher YMED, which runs the SOONCARE® appointment platform, was hit by an extortion attack claimed by the group XP95, which exfiltrated 132 GB of data covering 253,342 patients and over 431,000 medical files.
French cosmetics manufacturer Aircos Pascual, a subsidiary of the Anjac group, is targeted by a ransomware attack claimed by the group
On 5 April 2026, the DumpSec group advertised for sale a database it claims covers 35 million French patients tied to France's Regional Health Agencies (ARS), more than 130 hospitals and AP-HP, exposing identities, social security numbers and health records.
Following our article published on 5 April 2026, the company Nosho wanted to provide several clarifications on the incident: An attack on our database
In April 2026, a database of more than 820,000 Alltricks customer accounts (roughly 105 MB) was put up for sale on dark web forums, exposing names, emails, dates of birth, postal addresses, mobile numbers and loyalty data; the retailer disputes that the data came from its systems.
France's OFII immigration agency notified signatories of the Contrat d'intégration républicaine that a January 2026 breach via a compromised subcontractor exposed the names, emails, phone numbers and postal addresses of roughly 2.1 million people.
In April 2026, a database of roughly 105,000 French Ledger customers — stolen in the January 2026 breach of its e-commerce provider Global-e and exposing names, postal addresses, emails and phone numbers — was put back up for sale on a cybercrime forum.
OFII, France's immigration and integration agency, confirmed in April 2026 that a compromised subcontractor exposed personal data of foreigners enrolled in the Republican Integration Contract, with roughly 2.1 million records offered for sale on BreachForums.
On 4 April 2026, French gold buyer/reseller Or en Cash confirmed a data breach exposing the personal data of more than 70,000 customers — including identities, ID documents, contact details and transaction history — days after a similar attack on Gold Union.
Champagne house Veuve Clicquot disclosed in April 2026 that a ransomware attack on its third-party visit-booking provider exposed personal data of people who reserved cellar tours since at least July 2024, including names, dates of birth, phone numbers and emails.
Adobe is reportedly targeted by a massive data leak claimed by the hacker Mr. Raccoon, involving more than 13 million support tickets. The
In April 2026, the hacking group ShinyHunters claimed they had breached Amtrak. The group typically compromises organisations' Salesforce instances before demanding a ransom and later, if not paid, dumping the data publicly.
Fountain, a Belgian stock-listed provider of workplace coffee and refreshment services, disclosed in early April 2026 a ransomware attack involving unauthorized access to part of its IT systems and confirmed data exfiltration, with the DragonForce group claiming responsibility.
In early April 2026, the French cannery La Quiberonnaise confirmed that unauthorized access to its systems exposed customer personal data — names, postal addresses, email addresses and phone numbers — with the company notifying affected clients by email and reporting the breach to the CNIL.
In April 2026, the music trivia game platform SongTrivia2 suffered a data breach published to a public hacking forum, exposing roughly 291,000 user accounts including email addresses, names, usernames, avatars, auth tokens and bcrypt password hashes.
On 2 April 2026, a database with the personal details of 1,048,991 members of France's National Hunters Federation (FNC) — including names, postal addresses, phone numbers, emails and hunting-permit data — was offered for sale on the dark web.
In April 2026, French precious-metals dealer Gold Union suffered a data breach exposing records on more than 126,000 customers (2023-2026), including identities, addresses, transaction histories, IBANs and around 6,000 ID-card copies.
Insurance broker Maxance is hit by a data leak now publicly disseminated, affecting more than 348,000 people. Among the
French manufacturer Serap, the world's leading maker of farm milk cooling tanks, was hit by an Akira ransomware double-extortion attack disclosed on 2 April 2026, with the group threatening to publish around 50 GB of stolen internal data.
In April 2026, the music trivia platform SongTrivia2 suffered a data breach that was subsequently published to a public hacking forum. The data contained a total of 291k unique email addresses sourced from either Google OAuth logins or accounts created on the site, the latter also containing bcrypt…
Under Armour confirmed a breach by the Everest ransomware group that exposed roughly 72.7 million unique customer email addresses along with names, dates of birth, genders, locations and purchase histories, leaked publicly after extortion failed and now reaching French customers.
On 1 April 2026, French labour union Force Ouvrière (FO) was hit by a data breach claimed by an actor known as HexDex, who put up for sale a database of 161,343 member profiles including over 161,000 email addresses, 130,000 postal addresses and nearly 100,000 phone numbers.
On 1 April 2026, more than 506,000 profiles of young people enrolled in France's Missions Locales network were put up for sale on dark web forums, exposing full identities, contact details, and sensitive data on their education, employment, and social circumstances.
On 1 April 2026, the French Catholic school group Notre-Dame du Grandchamp was listed on NightSpire's leak site after a ransomware attack that exfiltrated roughly 330 GB of data, including students' medical records, academic files and HR data on thousands of pupils and staff.
Vacancéole, a specialist in holiday rentals in France, was the victim of a security incident involving a technical provider, confirming a
In March 2026, Hallmark suffered an alleged breach and subsequent extortion after attackers gained access to data stored within Salesforce. The data was later published after the extortion deadline passed, exposing 1.7M unique email addresses across both Hallmark and the Hallmark+ streaming…
On 31 March 2026, French camping and holiday-village operator Homair disclosed a data breach traced to a compromised third-party technical provider, exposing customers' names, email addresses, phone numbers and booking details (destination, stay dates, amount paid), while bank data, passwords and postal addresses were said to be unaffected.
On 31 March 2026, French tourist attraction La Mine Bleue notified customers that their personal data — names, postal code/country, email and purchase history — was exposed in the ransomware breach of its ticketing provider Vivaticket; no banking data was affected.
On 31 March 2026, Vaucluse Provence Attractivité — the Vaucluse département's public tourism and economic-promotion agency — disclosed a messaging-system compromise that let attackers send fraudulent emails from its official addresses, exposing the names and email addresses of people who had contacted it.
French holiday-club operator Belambra disclosed in March 2026 that a cyberattack on a shared reservation-system provider exposed personal data of roughly 400,000 customers, including names, emails, phone numbers and booking details, though no banking data or passwords.
On 30 March 2026, the Fédération Française de Savate had a database of roughly 679,000 licence-holder profiles spanning 49 years (1977–2026) stolen and put up for sale by an actor known as HexDex, exposing names, contact details and sports-licensing information.
On 30 March 2026, a database from GDQuest — a French e-learning platform for the Godot game engine — surfaced on a hacking forum, exposing learners' email addresses, usernames/account slugs and the titles and prices of purchased courses.
On 30 March 2026, the extortion group ALP-001 listed French telecom group Iliad (parent of Free) on its leak site, publishing a 5.4 GB sample of mobile-network engineering data — radio measurements, GPS drive tests, and network optimization records — and threatening fuller disclosure.
On 30 March 2026, French mortgage broker La Centrale de Financement suffered a 387 GB breach of its corporate network — more than 400,000 documents including KYC scans, bank statements and tax returns — later put up for sale for $25,000 after extortion talks failed.
In late March 2026, French e-cigarette retailer Le Petit Vapoteur was hit by a data breach after a hacker using the alias 'undef' put its customer database up for sale, exposing names, emails, phone numbers, postal addresses and IP logs for a claimed 3.3 million customers and 599 employees spanning 2012-2026.
On 28 March 2026, the Fédération Française Handisport disclosed a data breach exposing the records of 197,276 licensed members, including civil-identity, contact and sensitive health data such as disability type, with a database put up for sale by the actor 'HexDex'.
Around 27 March 2026, French IT services and engineering firm Scalian disclosed a cyberattack that leaked sensitive employee data — names, contact details, ID cards, vehicle registration papers and bank mandates — with the number of affected staff not yet known.
On 23 March 2026, French online tyre retailer Allopneus suffered a cyberattack on the software managing its home tyre-fitting service, exposing data on 453,299 unique customers across 739,316 records (2014–2026); no banking data or passwords were compromised.
A major data leak is reportedly currently targeting the Mondial Tissus chain. According to information circulated on a hacker forum, 365
In late March 2026, France's Système d'Information sur les Armes (SIA), the national firearms registry run by the Interior Ministry, was hit by a leak of records on 62,511 weapons and their owners after a company account was compromised and the data put up for sale.
On 27 March 2026 the European Commission confirmed a cyberattack on the cloud infrastructure hosting its Europa.eu web platform; the ShinyHunters extortion group claimed to have stolen 350+ GB of data and leaked over 90 GB, with around 30 EU entities potentially affected.
In March 2026, the hacker and extortion group "ShinyHunters" claimed to have obtained a substantial corpus of data from ZenBusiness, a business formation and compliance platform.
In March 2026, a breach of one of the many iterations of the BreachForums hacking forum known as "Version 5" was publicly disclosed. The incident exposed 340k unique email addresses along with usernames and argon2 password hashes.
On 26 March 2026, a breach at Les Champs Libres — the public cultural complex in Rennes — exposed user account data including names, email addresses, phone numbers and plain-text passwords.
In March 2026, the Colombian fintech company Addi identified unauthorised activity on its platform and advised customers that "it is possible that your personal information may have been compromised".
On 25 March 2026, French medical-laboratory network Cerballiance disclosed a breach traced to a compromised external IT provider that exposed patient identities, portal credentials, medical test reports and social security numbers.
On 25 March 2026 a security incident was disclosed at the French National Police's E-campus training platform, where an intruder accessed personal data of officers and administrative staff; a hacker claimed a database of 176,317 agent profiles.
In March 2026, the audio production tools company Sound Radix disclosed a data breach that they subsequently self-submitted to HIBP. The incident impacted 293k unique email addresses and names.
In March 2026, France's Cnous confirmed that an attacker exfiltrated data on 774,000 people from the Crous appointment platform mesrdv.etudiant.gouv.fr, including 139,000 individuals whose stolen files contained ID documents.
On 24 March 2026, anime streaming service Crunchyroll confirmed a data breach traced to a compromised third-party support vendor (Telus), exposing customer support-ticket data — names, emails, IP addresses and partial payment-card details — with a hacker claiming ~8M ticket records and ~6.8M unique email addresses.
In March 2026, the European Commission's Europa.eu web-hosting infrastructure was breached via a stolen AWS key (Trivy supply-chain compromise); ~91.7 GB of data covering 30+ EU entities — names, emails, email content and documents — was exfiltrated and leaked by ShinyHunters.
On 24 March 2026, the French Free Flight Federation (FFVL) was reported to have suffered a data leak exposing member records after unauthorized access to its systems; the volume of affected licence holders was not specified.
On 24 March 2026, the Métropole Aix-Marseille-Provence disclosed a data leak stemming from a compromised subcontractor, potentially exposing around 19,728 user accounts, including email addresses, names and passwords.
In late March 2026, a hacker put up for sale data on 62,511 firearms registered in France's Système d'Information sur les Armes (SIA), exposing owners' names, postal addresses, emails, phone numbers, weapon details and transaction histories.
I-Cad, France's national dog, cat and ferret identification registry, disclosed in March 2026 that a September 2025 software vulnerability had allowed automated querying of its database, exposing users' email addresses and fuelling phishing campaigns against pet owners.
Around 14 March 2026, US ignition-interlock provider Intoxalock was hit by a DDoS-style flood that knocked its servers offline for about a week, disrupting calibration and account services and leaving an estimated 150,000 court-ordered drivers across 46 states unable to start their cars.
In March 2026, France's General Secretariat of Catholic Education (SGEC) disclosed a cyberattack on an administrative application that exposed the personal data of around 1.5 million students, families and teachers, including names, dates of birth, postal addresses, emails and phone numbers.
In March 2026, French airsoft e-commerce retailer Airsoft-Entrepot was hit by a data breach exposing roughly 363,000 customers and 2.9 million orders spanning 2013-2026, including names, emails, postal addresses, phone numbers and order histories offered for sale by a threat actor.
On 20 March 2026, a database of the Confédération Musicale de France (CMF) — France's federation of amateur music ensembles and schools — was put up for sale by the actor HexDex, allegedly exposing 109,302 members including many minors, with identities, contact details, school records and disability notes.
La Mutuelle Familiale, a French complementary health insurer, disclosed a computer intrusion detected on 17 March 2026 that potentially affected its roughly 113,000 members, exposing identity documents, bank details (RIB) and health and insurance data.
On 19 March 2026, French vehicle-rental company Mingat confirmed a data leak affecting its customers, notifying them of a security incident that exposed personal information held in its rental records.
The 262,651 teachers, future teachers and trainee teachers are affected by a data leak tied to the system managing the education authorities. The incident covers a history of several…
French customers of luxury outerwear brand Canada Goose were caught up in a data leak by the ShinyHunters extortion group, with 10,816 records in the France-related subset of a broader corpus of roughly 600,000 customer records traced to a third-party payment processor.
Disclosed on 18 March 2026, the Musée des Arts et Métiers was caught up in the Vivaticket supply-chain ransomware breach, exposing online shop and ticketing customers' names, email addresses, account details and order history.
On 17 March 2026, the actor HexDex claimed on DarkForums a leak from the French Annuaire de l'administration, a centralized public-sector directory, exposing the names, phone numbers, professional and personal addresses, and job titles of roughly 60,000 government agents.
A March 2026 ransomware attack on the Bibliothèque Nationale de France's third-party online ticketing provider exposed the names and email addresses of users who had booked cultural events; banking data, handled by a separate vendor, was not affected.
Iran-linked hackers breached Los Angeles' transit agency LA Metro in March 2026, stealing at least 700 GB of internal data and disrupting passenger-information and TAP fare systems.
On 14 March 2026, a leak was claimed to expose roughly 594 phone numbers of Parisian Reconquête! members tied to Sarah Knafo's municipal campaign — a follow-on to the earlier public exposure of her campaign website's contributor data.
In March 2026, the League of Legends custom skins service Divine Skins suffered a data breach. The incident was disclosed via the service's Discord server, where Divine Skins stated that an unauthorised third party accessed part of its systems, deleted all skins from the database and exposed email…
On 13 March 2026, a threat actor claimed to have leaked a database belonging to GPS Santé, a French health-tech firm offering online medical scheduling and teleconsultation, allegedly exposing data on roughly 890,000 patients and practitioners.
On 13 March 2026, a dataset claimed to come from the French therapist-booking platform Therapeutes.com was put up for sale, exposing around 71,502 patients along with nearly 199,697 appointment records and highly sensitive mental-health consultation details.
Students, staff and partners of Université Paris-Est are affected by a confirmed leak affecting the establishment's administrative files. Approximately 315,000 lines of…
On 12 March 2026, French alternative-medicine booking platform Medoucine confirmed a data breach in which a database of 813,866 users — including about 6,500 practitioners — was put up for sale, exposing names, emails, phone numbers and consultation history.
On 11 March 2026, a database belonging to INTERSPORT Rent — the ski- and snowboard-equipment rental arm of the Intersport sports retail group — was dumped on a hacker forum, exposing roughly 1.2 million rows covering about 476,282 unique customers, including names, emails, phone numbers, loyalty numbers and rental order histories.
A claimed leak of Pronote login credentials (email addresses and passwords) belonging to French students and parents was reported circulating for sale on the dark web; publisher Index Education stated its own systems were not breached, the credentials stemming from phishing and account theft.
The Iranian state-linked group Handala compromised Stryker's Microsoft Intune administrator account and used the endpoint-management tool to wipe more than 200,000 servers, mobile devices, and corporate endpoints across 79 countries — bringing operations at one of the world's largest medical-device makers to a halt.
On 2 March 2026, ticketing platform Vivaticket disclosed a RansomHouse ransomware attack that exfiltrated customer data — names, emails, postal codes and purchase history — affecting users of 3,500 partner venues including the Louvre and the BnF.
Members of the ASPTT Multi-Sports Federation may be affected by a claimed leak involving more than a million registrations, for the 2014-2026 period, according to the claim...
In March 2026, France's Région Occitanie disclosed a breach of its Carte Jeune Région scheme after a technical service provider was compromised, exposing the personal data of about 310,000 young beneficiaries — including some 270,000 ID photos of minors — which the DumpSec group put up for sale on the dark web.
On 9 March 2026, French AMF-regulated asset manager Vatel Capital emailed its clients to disclose an accidental exposure of files that occurred between 21 February and early March 2026, affecting personal data held by the firm.
On 8 March 2026, a threat actor put a 121 GB database from flight-compensation platform Airclaim up for sale on a hacker forum, claiming 55,867 affected passengers — including 1,042 French nationals — with scanned passports, signatures and boarding passes exposed.
In March 2026, the Turkish restaurant chain Baydöner suffered a data breach which was subsequently published to a public hacking forum. The incident exposed over 1.2M unique email addresses along with names, phone numbers, cities of residence and plaintext passwords.
Members of FNATH are affected by a claimed leak involving nearly 75,000 people, according to the claim. The association supporting victims of life accidents is reportedly the subject of a...
On 8 March 2026, a data leak was claimed against French ready-to-wear and denim brand Le Temps des Cerises, reportedly exposing personal details of roughly 800,000 customers who had ordered through its website.
In March 2026, a threat actor put a fresh database of 1,342,952 customer records from Stych — a French online driving school — up for sale on a hacking forum, exposing names, contact details, postal addresses, dates of birth and driving-training profile data.
On 7 March 2026, a threat actor claimed a data leak at Ordoclic, a French e-prescription and e-health provider, allegedly exposing data on nearly 4,600 people including patients and business contacts; the claim remains unverified.
SYNLAB France customers and partners are potentially affected, according to the claim by the HexDex collective. The group claims to hold 161 GB of internal data belonging to the…
In March 2026, the online safety service Aura disclosed a data breach that exposed 900k unique email addresses. The data was primarily associated with a marketing tool from a previously acquired company, with fewer than 20k active Aura customers affected.
In early March 2026, France's Centre des Monuments Nationaux disclosed a data leak stemming from a ransomware attack on its online ticketing provider, exposing visitors' emails, names, postal addresses, purchase history and hashed passwords, but no banking data.
Systems linked to TAJ, used by the French Police and Gendarmerie, are allegedly affected by a claimed leak. According to the claim, a data package allegedly presents a complete system image…
On 5 March 2026, a database of 713,814 people who had submitted rental applications on the French student-housing platform ImmoJeune was offered for sale on a cybercrime forum, exposing names, emails, phone numbers, postal addresses and income details.
On 5 March 2026, a threat actor known as st0jke claimed to have breached Penninghen, a Paris art and design school, and offered for sale roughly 14 GB of data on around 25,000 students and parents, including photos, IBANs, ID documents and the platform source code.
On 4 March 2026, a threat actor claimed on a hacking forum to be selling a database tied to France's Agence Nationale de la Cohésion des Territoires (ANCT), allegedly exposing professional and contact details of around 15,000 employees and administrative contacts, with a sample posted as proof.
On 4 March 2026 the Fédération française des Banques Alimentaires confirmed a data breach exposing personal records of 659,658 aid-recipient families — about 1,462,485 people — including identity, contact, family-situation, income and aid-history details.
On 4 March 2026, a threat actor claimed to have leaked roughly 8,220 customer accounts belonging to Au Brouillon de Culture, a long-established bookshop in Nice, France, that also sells books through its online store.
In March 2026, the personal development and achievement media brand SUCCESS suffered a data breach. The incident exposed 250k unique email addresses along with names, IP addresses, phone numbers and, for a limited number of staff members, bcrypt password hashes.
In March 2026, the AI-driven merchant data platform Woflow was named as a victim by the ShinyHunters data extortion group. The group subsequently published tens of thousands of files allegedly obtained from the company, comprising more than 2TB of data.
In March 2026, a lone hacker known as Gr0lum fully compromised the French BitTorrent tracker YggTorrent, exfiltrating roughly 6.6 million user accounts plus emails, password hashes, IP addresses and 54,776 plaintext bank card records before the site shut down permanently.
On 3 March 2026, Be-bunk, a fintech payment provider serving French overseas territories, confirmed a data breach affecting around 13,000 customers, with an actor claiming a 75-million-line database including IBANs, balances and identity data.
On 3 March 2026, French flower-delivery service Florajet confirmed unauthorised access to its B2B ordering tool after a criminal put 1,457,473 order records (2023-2026, ~136 GB) up for sale, exposing names, full postal addresses, ~952,000 phone numbers and intimate accompanying messages.
In March 2026, the financial services firm Ameriprise Financial was named by the ShinyHunters group in a "pay or leak" extortion campaign. The group claimed possession of more than 200GB of compressed data exfiltrated from Ameriprise's Salesforce environment and internal SharePoint infrastructure,…
Bioserveur's patients are reportedly affected by a claimed leak involving approximately 2,200 PDF documents, according to the claim. These files are described as test result reports…
Cloud Imperium Games, developer of Star Citizen and Squadron 42, disclosed in March 2026 that a January attack on its backup systems gave intruders read-only access to player account data including names, usernames, dates of birth and contact details.
In early March 2026, French aerospace and automotive fastener manufacturer LISI Group was hit by the Qilin ransomware gang, which exfiltrated a limited set of corporate data — bank account/IBAN details, supply contracts, confidentiality agreements and employee information — from two ancillary sites.
In early March 2026, MDPH 92 — the Hauts-de-Seine disability services agency — accidentally exposed around 500 beneficiaries' email addresses by sending a mass post-cyberattack notice with recipients in CC instead of BCC.
Customer data of the Oceanographic Museum of Monaco was exposed via a ransomware attack on its ticketing provider Vivaticket (subsidiary Irec SAS), disclosed 2 March 2026 and claimed by RansomHouse, leaking names, emails, phone numbers, postal locations and order/booking history.
On 2 March 2026, the Palais de la Porte Dorée was among 40+ French cultural institutions affected by a ransomware attack on shared ticketing provider Vivaticket, potentially exposing visitors' names, contact details, dates of birth, purchase histories and encrypted passwords.
On 2 March 2026, the City of Paris confirmed a data breach affecting the Cours d'Adultes de Paris (adult education) platform, exposing names, dates of birth, emails, postal addresses and phone numbers of users registered before May 2025; no passwords or banking data were affected.
In early 2026, French digital-infrastructure consultancy Tactis was hit by the Qilin ransomware gang, which listed the firm on its leak site and threatened to publish exfiltrated internal data covering its telecom and smart-city projects for public and private clients.
On 2 March 2026, a cybercriminal claimed to have breached Tchap, the French state's secure messaging service run by DINUM, exposing data tied to around 10,000 members and naming internal rooms linked to the Interior Ministry and security forces.
On 2 March 2026, Orléans city hall warned ticket buyers that its online booking provider Vivaticket was hit by a RansomHouse ransomware attack; exposed customer data may include names, emails, country, postal code and purchase history, but no banking details.
On 1 March 2026, a threat actor claimed to have stolen a database from BE ATEX, a French industrial safety-equipment distributor near Toulouse, allegedly exposing personal data on roughly 2,500 of the firm's clients and employees.
On 28 February 2026, the French Aeronautics Federation (FFA) disclosed unauthorised access to its SMILE member-management platform, exposing the names, dates of birth, emails and postal addresses of 343,734 members, with archives reaching back to 2002.
Licence holders of the French Rugby XIII Federation are affected by a confirmed leak involving photos and licence information. Nearly 37,000 of the exposed photos relate to...
France's school-sport federation UNSS disclosed in late February 2026 that intruders accessed its OPUSS membership platform and leaked personal data and roughly 1.5 million ID photos of student athletes (11-18) on the darknet, spanning ~668,000 current and ~889,000 former members.
On 28 February 2026, the group DumpSec claimed it had exfiltrated about 65 GB of data and roughly 1.5 million student identity photos from the French school sports federation UNSS, after breaching its OPUSS intranet; names, birth dates, schools and contact details were exposed.
On 25 February 2026, the LAPSUS$ group claimed a breach of NextSend, the file-transfer platform (edited by Hegyd) used internally by French construction group Eiffage, publishing 77 files exposing 175,942 employees and external contacts.
In late February 2026, ESPCI Paris (a PSL University engineering and research school) disclosed that an access-control flaw let unidentified actors harvest its internal directory, exposing identity and contact details of students, staff and external personnel; passwords were not affected.
In late February 2026, France's gymnastics federation (FFGym) disclosed a breach of its FFGym Licence system via a phished club account, exposing data on roughly 2.9 million current and former licensees registered since 2004.
In late February 2026, a threat actor advertised a database of 203,179 members of the French Ski Federation (FFS), spanning records from 1999 to 2026 and exposing civil-status details, contact data and family information; the FFS confirmed the breach and notified the CNIL.
In February 2026, Unibail-Rodamco-Westfield disclosed unauthorised access to a database holding Westfield Club loyalty members' and newsletter subscribers' names, email addresses, phone numbers, postcodes and dates of birth; no financial data or passwords were exposed.
The records of nearly 15 million patients managed via software from publisher Cegedim are affected by a confirmed leak. The publicly released elements indicate that this data comes from…
The French Gymnastics Federation (FFGym) suffered a data breach disclosed in early 2026 in which attackers used a phishing-compromised club account on the FFGym Licence platform to access personal data of roughly 2.9 million current and former members licensed since 2004.
Licence holders and members of the French Karate Federation are affected by a claimed data leak, according to the claim. According to the announcement, a FFK database has been...
The Sports and Cultural Federation of France (FSCF) had the personal data of roughly 1.33 million members exposed after a third-party licence-management provider was compromised, leaking names, dates of birth, postal addresses, contact details and licence/membership records.
Customers and prospects of Santeo, a health insurance comparator, are reportedly affected by a claimed data leak impacting around 116,122 people, according to the claim published on 26…
In late February 2026, France's family-allowance fund CAF disclosed that around 70,000 RSA welfare recipients' dossiers were exposed after the HubEE inter-agency document platform was breached, leaking names, social-security numbers and contact details.
Disclosed in late February 2026, a compromise of HubEE — the inter-administrative document-exchange platform operated by France's DINUM — exposed personal data of RSA welfare claimants, with roughly 70,000 dossiers (about 160,000 documents) affected; no banking data or passwords were exposed.
Members of the French Aikido, Aikibudo and Associated Federations (FFAAA) are affected by a claimed leak of their personal data. According to the claim, a corpus of 352,502…
In February, the AI-powered comic generation platform KomikoAI suffered a data breach. The incident exposed 1M unique email addresses along with names, user posts and the AI prompts used to generate content. The exposed data enables the mapping of individual AI prompts to specific email addresses.
In February 2026, the couples and relationship app Lovora allegedly suffered a data breach that exposed 496k unique email addresses. The data also included users’ display names and profile photos, along with other personal information collected through use of the app.
In late February 2026, a threat actor known as DumpSec advertised the sale of data allegedly stolen from French digital temp agency MyConnect — around 125,000 records and 18 GB of files (ID scans, bank details, birth certificates) for some 16,000 people.
On 24 February 2026, a threat actor claimed to have leaked a database of 8,571 KYC identity-verification documents belonging to clients and project owners of Ayomi, the French equity-crowdfunding and fundraising platform for SMEs and startups.
A threat actor claimed to have leaked a database of 74,312 business-customer records from French software publisher Cegid, exposing company names, contact details, IBAN/RIB bank identifiers and invoice metadata for clients in France, Belgium and Spain.
On 24 February 2026, a threat actor claimed to be selling a database of 728,732 members of the French Motor Sport Federation (FFSA), exposing names, dates of birth, postal and email addresses, phone numbers and licence details after a third-party provider was compromised.
In February 2026 the LAPSUS$ extortion group claimed the theft of about 420 GB of data from France's Civil Aviation Safety Organisation (OSAC), including ID cards, passports, diplomas, proof-of-address documents and internal files; the data was later leaked in full.
In February 2026, a database of around 11.4 million records belonging to licensed athletes, officials and coaches of the French Athletics Federation (FFA) was put up for sale, exposing personal details and millions of passwords, including roughly 3 million in plain text.
Mondial Relay customers are affected by a confirmed data leak impacting approximately 5 million records. The published elements indicate this is a corpus aggregated from…
Olympique de Marseille customers are reportedly affected by a claimed leak impacting nearly 400,000 people, according to the claim. The publication announces the sale of a database…
On 23 February 2026, the civic-service association Unis Cité was hit by a data breach exposing roughly 80,000 people and around 40 GB of data, including national ID cards, photos, IBANs and other sensitive documents on young volunteers, claimed by the DumpSec group.
The French Badminton Federation disclosed that an unauthorized export from its internal Poona membership platform, traced to a compromised administrator account and discovered in September 2025, exposed personal data on roughly 300,000 licensed members, including names, dates of birth, contact details and parents' names.
On 22 February 2026, a hacker known as "84City" claimed to have breached MaSalleDeSport, a CRM and management provider for 2,000+ French gyms (Basic-Fit, Fitness Park, ON AIR Fitness, L'Orange Bleue), exposing member names, phone numbers, SMS and addresses for a potential 1M+ people.
An unprotected MongoDB database linked to identity-verification provider IDMerit exposed roughly 1 billion KYC records across 26 countries, including full names, addresses, dates of birth, national ID numbers, phone numbers and emails.
On 21 February 2026, Innovorder — a French SaaS provider of POS and management software for the foodservice industry — confirmed a data breach after a dataset of around 41,000 records, accessed via credentials compromised in an unrelated breach, was offered on a hacking forum.
On 20 February 2026, a threat actor claimed a data leak at Azaé, the French home personal-services provider, allegedly exposing personal information on roughly 19,000 clients and employees; the claim remains unconfirmed by the company.
On 20 February 2026, a dataset of roughly 65,000 records on French National Gendarmerie personnel surfaced online, scraped in March 2025 from the inter-ministerial RESANA collaboration platform and exposing names, contact details and job assignments.
On 20 February 2026, a threat actor put up for sale on BreachForums a database claimed to belong to French gym chain KeepCool, affecting some 400,000 members across 270 clubs and exposing names, emails, phone numbers and some IBANs.
On 20 February 2026, a compilation of personal data covering 8,861 staff of the French Ministries of the Interior and Armed Forces — including names, dates of birth, contact details and internal identifiers — surfaced on underground forums, part of a wider aggregate of leaks affecting French public agents.
On 20 February 2026 the LAPSUS$ extortion group claimed to have stolen about 420 GB of data from France's civil-aviation safety body OSAC, including ID documents, passports and internal files; the full dataset was later published online.
PayPal disclosed in February 2026 that a coding error in its PayPal Working Capital (PPWC) business-lending platform exposed the personal data — including names, dates of birth, SSNs and business addresses — of around 100 customers, some of whom in France, for nearly six months.
On 20 February 2026, a compiled database exposing 2,393 French state agents — from the Police, Gendarmerie, Defence ministry, DGSI, DGSE, Customs and the CNIL (including 86 CNIL staff) — was published on underground forums, leaking identity, contact and professional details aggregated from hundreds of prior breaches.
In February 2026, the French Canoe Kayak and Paddle Sports Federation (FFCK) had a member database covering decades of licence-holders leaked and offered for sale, exposing the names, dates of birth, postal addresses, phone numbers, emails and club/licence details of roughly 393,374 people.
In February 2026, the French Ministry of Sports, Youth and Community Life had data on roughly 450,000 candidates exfiltrated from its FORÔMES sports/youth training platform after a legitimate training organisation's account was compromised, exposing names, contact details and dates and places of birth.
On 19 February 2026 the French Ministry of Sports disclosed that data on roughly 450,000 candidates was exfiltrated from its FORÔMES training and diploma platform after a legitimate training-organisation account was compromised, exposing names, contact details and dates and places of birth.
On 19 February 2026, the Incransom ransomware group claimed to have stolen 279 GB of data (225,372 files) from French environmental-remediation firm Valgo SA, including contracts, NDAs, financial records and client data naming Renault Group and others.
On 18 February 2026, France's CFDT trade union confederation confirmed a data breach exposing the names, postal addresses and union-affiliation details of up to 1.4 million current and former members, after an attacker abused a hijacked regional manager's account.
French family-clothing retailer Cyrillus reported a customer data leak originating from one of its third-party providers, detected on 13 February 2026 and confirmed from publicly disclosed elements; the full number of affected customers was not made public.
France's tax authority (DGFiP) disclosed on 18 Feb 2026 that an attacker who hijacked a civil servant's credentials accessed FICOBA, the national bank-account registry, exposing identity, address, IBAN and in some cases tax-ID data for about 1.2 million account holders.
In February 2026, personal data belonging to thousands of employees was found circulating on the dark web after a breach of Espace CE (Espace CSE), a French platform managing benefits for Works Councils; exposed fields included names, contact details, dates of birth and hashed passwords.
France's Ministry of the Economy and Finance disclosed that an intruder who usurped a civil servant's credentials had illegitimately accessed the national bank-account registry FICOBA from late January 2026, exposing the IBAN/RIB details, identity, address and in some cases tax ID of holders of about 1.2 million accounts.
Students, their parents and staff at Lycée Carnot Paris could be affected by the disclosure of approximately 5,022 user records. According to the claim, these records were reportedly…
On Air Fitness members and former members are reportedly affected, according to the claim, by a data leak impacting around 512,000 people. According to the announcement, the files cover…
On 18 February 2026, Réglo Mobile — the E.Leclerc/SFR-backed mobile virtual operator — disclosed that a subcontractor breached from 13 February exposed data on about 358,000 customers, including identity, contact details, dates of birth, PUK codes, call records and partial banking data, with the database offered for sale by actor "84City".
In February 2026, a threat actor claimed to have breached the intranet of European broadcaster RTL Group, exposing an internal directory of more than 27,000 current and former employees including names, work emails, addresses, phone numbers and job details.
Axa France customers are affected, according to the claim, by an announced leak that would impact more than 8 million people. The claim indicates that 'data and access' were…
In February 2026, the porn addiction app Quitbro allegedly suffered a data breach that exposed 23k unique email addresses. The data also included users’ years of birth, responses to questions within the app and their last recorded relapse time.
Adidas customers and partners are affected by a confirmed leak that exposes personal and commercial information. According to available information, around 1,617 people have been…
Permanent and non-permanent staff who worked at CNRS before 31 December 2006 are affected by a data leak confirmed by CNRS. The exact volume of exposed information has not…
Customers of Socloz partner brands are affected, according to the claim, by the exfiltration of approximately 31 million booking lines in early 2026. Socloz is a platform…
Voyage Privé, the French flash-sale travel platform, confirmed in February 2026 that a compromised third-party partner exposed reservation data for customers with upcoming trips — including names, country of residence, emails, phone numbers and, in some cases, passport numbers — fuelling a wave of WhatsApp phishing.
On 15 February 2026, the Lapsus$ group listed a database allegedly stolen from French engineering school EPITA on BreachForums, claiming records on 14,753 students and staff including names, email addresses, graduation years and profile photos.
In February 2026, the automotive marketplace CarGurus was the target of a data breach attributed to the threat actor ShinyHunters. Following an attempted extortion, the data was published publicly and contained more than 12M email addresses across multiple files including user account ID mappings,…
Members of the French Radio-Controlled Cars Federation (FFVRC) may be affected by a claimed leak involving nearly 98,000 people. According to the claim, 97,795...
Chez Switch customers are, according to the claim, affected by a data leak that would impact nearly 19,300 people. Chez Switch presents itself as an energy supplier and…
Customer data of French womenswear retailer Grain de Malice was exposed in February 2026 through a breach of its omnichannel retail provider Socloz, leaking names, email addresses and phone numbers as part of a dataset of up to ~31 million records.
Gustave-Auto, a French automotive services platform (vehicle convoyage, fleet management and repairs), disclosed in February 2026 that an access anomaly exposed partner data — names, postal and email addresses, phone numbers, IBAN/BIC banking details and SIRET/VAT numbers — with a tracker claim citing around 3,600 records.
A threat actor claimed to have stolen data tied to Kimsufi, the budget hosting brand of French cloud provider OVHcloud, alleging exposure of roughly 1.6 million customers and data from 5.9 million hosted websites; OVHcloud denied the breach, saying the sample did not come from its systems.
On 11 February 2026, French food-aid charity Les Restos du Cœur suffered a cyberattack on an internal system, exposing the personal data of its employees and volunteers, including names, roles, departments, email addresses and phone numbers.
In February 2026, the French Judo Federation (France Judo) suffered a breach of its federal extranet in which the group RavenSec stole and offered for sale roughly 2.4 million records covering 533,730 licence holders, including photos, 948 national ID cards, social security numbers and medical data.
In February 2026, Dutch telco Odido was the victim of a data breach and subsequent extortion attempt. Shortly after, a total of 6M unique email addresses were published across four separate data releases over consecutive days.
The town hall of Bourg-Achard (Eure, Normandy) disclosed a cyberattack dating to 29 January 2026 that led to a data leak, with municipal room-reservation records among the information exposed; the CNIL, gendarmerie and ANSSI/Normandie Cyber were notified.
On 10 February 2026, a threat actor claimed to have stolen 13,016 unique customer records from Birdee, the online savings and robo-advisor platform, allegedly extracted from two database files containing account holders' personal details.
Ciffreo Bona customers are affected by a claimed leak involving nearly 70,000 accounts, according to the claim. The announced file would cover 15 years of activity (2009-2024) and…
In February 2026, a database tied to French aerospace and defense group Safran surfaced on a hacking forum, exposing roughly 718,716 order records — names, emails, phone numbers, ERP references and logistics data — leaked through a third-party provider rather than Safran's own systems.
Disclosed on 9 February 2026, a data leak at French insurance-delegated-management firm Aïkan, traced to an intrusion detected on 15 January, exposed personal data of policyholders managed on behalf of partners Flitter and Wakam.
A dataset of 4,198,129 rows tied to Groupe Atalian — a global facility-services and cleaning company — surfaced on BreachForums, exposing HR records including names, dates and places of birth, addresses, nationalities, contract and payroll details, and immigration-card numbers.
A January 2026 breach of Info Jeunes Bourgogne-Franche-Comté's Carte Avantages Jeunes platform exposed the personal data of roughly 283,000 cardholders, including names, dates of birth, addresses, phone numbers and identity documents, later put up for sale on the dark web.
Maxance customers are, according to the claim, affected by the publication of 348,346 records containing personal and contractual information. The file is announced as…
Customers who placed or attempted an order on PharmaShopi are affected by a confirmed leak. The site, an online pharmacy and parapharmacy, had payment information exposed…
In February 2026, French company Prozon disclosed a data breach affecting its customers after an attacker gained unauthorised access to one of its infrastructure tools; the company confirmed the incident and notified France's data-protection regulator, the CNIL, though the volume of affected records was not specified.
On 9 February 2026, a threat actor published a claimed CRM database export from a Renault dealership network in south-eastern France (PACA), exposing roughly 12,143 customer records including names, contact details, addresses and vehicle information.
In February 2026, identity-verification (KYC) provider Sumsub disclosed a 2024 breach — undetected for ~18 months — in which an attacker reached a customer-support environment and exposed the names, email addresses and phone numbers of clients of crypto and fintech platforms it serves.
On 8 February 2026, a threat actor claimed to have leaked data on roughly 28,000 customers and staff of Immo-pop, the French fixed-fee online real estate agency; the claim was logged by a French breach tracker and remains unverified by the company.
Participants registered via Rankfyt are affected by a data leak impacting 1,227 registrations, with details concerning more than 2,000 linked people (teammates). The files…
On 7 February 2026, a threat actor claimed a data leak from French eldercare platform CetteFamille, exposing the names, email addresses and account status of around 12,711 coordinators across roughly 333,000 documents (about 41 GB).
In early February 2026 the French Office for Biodiversity (OFB) disclosed that an intrusion into its national hunting-licence application exposed personal data of licence candidates, applicants and holders — including full identity, contact details, nationality and licence numbers.
In early February 2026, the Qilin ransomware group listed French coach-travel operator Voyages Robin on its dark-web leak site, claiming to have stolen customer booking details, travel itineraries and financial records.
The French Table Tennis Federation (FFTT) disclosed a cyberattack in which a compromised account was used to bulk-extract licence-holder records — names, dates and places of birth, nationality, licence numbers and contact details for an estimated 210,000–254,000 members; no banking or health data was affected.
In early February 2026, France's national sailing federation (FFVoile) disclosed a data breach of its licence-management platform via a compromised club account, exposing personal data of several hundred thousand licensees including names, birthdates, addresses, emails, phone numbers and disability status.
A leaked file from the City of Paris's municipal adult-education platform (Cours municipaux pour adultes) exposed the personal data of 320,292 registered users, including names, dates of birth, postal addresses, phone numbers and email addresses; no passwords or banking data were involved.
In February 2026, the online gaming community Toy Battles suffered a data breach. The incident exposed 1k unique email addresses alongside usernames, IP addresses and chat logs. Following the breach, Toy Battles self-submitted the data to Have I Been Pwned.
On 5 February 2026, the threat group RavenSec claimed a breach of France's ADMR home-care network, leaking member data — names, email and postal addresses and organisation details — with over 10,000 people initially affected and a claimed underlying database of millions.
On 5 February 2026 a threat actor claimed to be selling a database holding the professional email addresses of 15,108 staff of France's Agence Régionale de Santé (ARS), alongside other work-related details, on a cybercrime forum.
On 5 February 2026, a threat actor known as sux1337 claimed to have leaked 7,665 lines of patient data from Asten Santé, a French home-healthcare provider, publishing the records for free on a cybercrime forum days before the company suspended its patient and prescriber extranets for security reasons.
In early February 2026, a hacker put up for sale a database of 66,343 people supported by the CCAS of Dunkerque, exposing names, dates of birth, postal addresses, phone numbers, emails and family-situation details of social-aid beneficiaries.
On 5 February 2026, a threat actor claimed to have leaked roughly 4,000 lines of data concerning authorising officers (agents ordonnateurs) at France's Centre National de Gestion, the public body managing HR for hospital practitioners and healthcare directors.
Family Cinema customers would be affected by a data leak, according to the claim. The advertised batch would contain nearly 156,489 orders and 39,896 unique customers, covering the period…
On 5 February 2026, the French Hiking Federation (FFRandonnée) was named in a claimed data leak said to expose the personal records of 813,983 members, part of the 2026 wave of breaches hitting French sports federations through shared licensee-management systems.
Flickr users residing in Europe are affected by a metadata exposure that hit the service in February 2026. According to the official announcement, approximately 228,000 European accounts...
In early February 2026, Protexia France — the legal-protection insurance subsidiary of Allianz France — was reported to have suffered a data breach exposing personal information belonging to its policyholders and contacts.
On 4 February 2026, the Collège-Lycée Notre-Dame des Dunes, a private Catholic secondary school in Dunkirk, France, disclosed a confirmed data leak affecting roughly 1,150 people, mainly its pupils and the staff and external contributors connected to the school.
The 553 pupils enrolled in the Sports Association of Collège Saint-Charles (Guipavas/Brest) were exposed in the wider UNSS school-sports breach, with their names, dates of birth, school and ID photos leaked online after the federation's OPUSS platform was compromised.
On 4 February 2026, French equipment-rental group Loxam disclosed a breach of a third-party delivery-planning system that exposed roughly 60 GB of logistics data — 94,735 delivery routes and about 828,000 geolocated stop-points covering 2020-2026, plus customer, driver and vehicle details.
France's state recruitment portal Choisir le service public disclosed in early February 2026 a breach exposing the application profiles of 377,418 candidates after attackers abused a compromised manager account; names, contact details, birth dates and career data were leaked and offered for sale.
Substack disclosed in February 2026 that an unauthorized third party scraped its systems, exposing roughly 697,313 user records including email addresses, phone numbers, names, user and Stripe IDs, and profile metadata; passwords and financial data were not affected.
A compromise of a third-party appointment-scheduling tool used by Darty's kitchen design service exposed personal and project data on 79,164 French customers, including names, postal addresses, emails, phone numbers and kitchen budgets, with no passwords or banking data affected.
In late January 2026, a hacker claimed to have exfiltrated 2,971 files (about 4.5 GB, including 1,533 PDFs) from the French Army (Armée de Terre) via a compromised account, with documents marked 'Diffusion Restreinte' (restricted distribution) and internal technical guides.
A threat actor claimed to have stolen and put up for sale a database of about 66,343 beneficiaries of the CCAS de Dunkerque, France's municipal social-welfare body, exposing names, emails, phone numbers, dates of birth, addresses and household details.
Disclosed on 31 January 2026, a confirmed data leak at France's Inria research institute exposed personal records of about 21,647 staff and collaborators from Inria, IRISA and partner research units, including names, dates of birth, postal addresses and household details.
On 31 January 2026, a dataset advertised on BreachForums as the 2026 directory of French locum (replacement) doctors was claimed to expose roughly 23,535 records, including names, emails, phone numbers and professional practice-authorisation numbers.
On 30 January 2026 a 1.06 GB SQL database stolen from French first-aid non-profit ANPS was posted to BreachForums, exposing roughly 5,600 unique email addresses along with names, dates and places of birth traced back to a legacy system.
In January 2026, a data breach impacting the French non-profit Association Nationale des Premiers Secours (ANPS) was posted to a hacking forum. The breach exposed 5.6k unique email addresses along with names, dates of birth and places of birth.
In late January 2026, French driving-education company Codes Rousseau disclosed unauthorized access to its Easysystème platform, exposing learner identity and contact details, ID photos, signatures and NEPH driving-licence numbers; ~30,000 records were later put up for sale.
Codes Rousseau disclosed unauthorized access to its Easysystème driving-school platform, used by nearly all French driving schools, exposing learner drivers' identity data including names, contact details, ID photos, signatures and NEPH licence numbers.
People with a ManoMano account are affected by a data leak hitting the online DIY and gardening site. Nearly 38 million accounts are reportedly involved, according to…
On 30 January 2026, a data leak at Opquast — the French web-quality assurance and certification company based in Mérignac — exposed the email addresses of around one hundred people.
In early 2026, data purportedly sourced from the recipe and meal planning service Provecho was alleged to have been obtained in a breach. The exposed data included 713k unique email address along with username and the creator account holders followed.
Customers of FranceCasse.fr are, according to the claim, affected by a leak exposing more than a million profiles. According to the claim, a 98 GB file structured via PrestaShop...
On 29 January 2026, Match Group — parent of Hinge, Match and OKCupid — disclosed a breach after the ShinyHunters group used a vishing attack to hijack an employee Okta SSO account; exposed PII included names, dates of birth, phone numbers and IP addresses.
In late January 2026, a cybercriminal put up for sale on a hacking forum a 500 GB trove of more than 1.18 million files stolen from eleven French real estate agencies, exposing the personal, contractual and financial data of at least 20,000 owners, tenants, co-owners and suppliers.
On 29 January 2026, a full database dump from Reseau.site — a French SaaS platform for merchants and craftspeople — exposed 126,998 customer records, including names, contact details, hashed passwords, bank card numbers and IBANs.
On 29 January 2026, French luxury travel agency VeryChic, which specialises in private sales of hotel stays and trips, was hit by a confirmed data leak affecting roughly 900,000 customer records.
On 28 January 2026, a leak of roughly 1.18 million files (500+ GB) affecting 11 French real estate agencies — including Marteau Immobilier (Orpi), AFG Immobilier and Trenta Immobilier — was put up for sale on a cybercrime forum, exposing IDs, IBANs, contracts and credentials of an estimated 20,000+ owners, tenants and co-owners.
On 28 January 2026, patient personal data from the Centre d'Imagerie Médicale de Puteaux — a radiology and medical imaging centre in the Hauts-de-Seine — was exposed in a confirmed data breach, including names, dates of birth, contact details and appointment history.
In February 2026, data obtained from the fintech lending platform Figure was publicly posted online. The exposed data, dating back to January 2026, contained over 900k unique email addresses along with names, phone numbers, physical addresses and dates of birth.
A dataset tied to the Conservatoire National des Arts et Métiers (CNAM), the French public higher-education institution, was reported leaked around 28 January 2026, exposing personal records for roughly 10,000 people including names, contact details, dates of birth and job information.
On 28 January 2026, a data leak was claimed against Lovys, a French 100% digital neo-insurer, allegedly exposing customer records; the scale and exact data categories remain unverified.
On 28 January 2026, a dataset exposing personal details of roughly 600 students linked to UGSEL — the French Catholic-schools sports federation — surfaced online, including names, gender, dates of birth and class/category information.
On 28 January 2026, a data leak affecting Wemind, the French neo-insurer for freelancers and small businesses, exposed members' contact details — names, postal addresses, email addresses and phone numbers — through its Allianz insurance/back-office channel.
On 27 January 2026, a database tied to O'Tacos' loyalty programme and mobile app surfaced for sale on a hacking forum: a 9 GB JSON dump of roughly 29 million user records, about 10 million with full identity details, across the French chain's international markets.
On 27 January 2026, French B2B equipment marketplace Techni-Contact was hit by a confirmed customer data leak, with a corpus of roughly 5.88 million records circulating that exposed customer contact and account details.
Customers and contacts of AutoForever are affected by a confirmed data leak, with the volume remaining unspecified. The company states it does not know whether personal data was stolen following…
On 26 January 2026, Lyleoo, a French ophthalmology tele-expertise platform, confirmed a data breach after attackers used a partner optician's stolen credentials to access its systems; the DumpSec group leaked about 900,000 records of user contact details.
French mobile and internet operator Coriolis Télécom was hit by a data leak in which a hacker put a 356 MB database of 508,276 customer records — including names, postal and email addresses, dates of birth, IBAN/BIC bank details and business SIRET numbers — up for sale on a dark-web marketplace.
On 25 January 2026, the Fédération Française Sports pour Tous saw the personal data of 1,493 of its members exposed, including names, postal addresses, phone numbers, member status, affiliated club, qualifications and activities.
On 25 January 2026, a threat actor claimed to have leaked order-related customer data from the French secondhand-bookshop cooperative Livrenpoche (Livre en Poche), with roughly 683,936 rows reportedly affected; the claim is unverified by the company.
On 25 January 2026, a SQL dump of internal databases belonging to Sciences Po — the Paris Institute of Political Studies — surfaced online, exposing data held by the higher-education institution as part of a broader wave of French data leaks that month.
In January 2026, data allegedly sourced from US automotive retailer CarMax was published online following a failed extortion attempt. The data included 431k unique email addresses along with names, phone numbers and physical addresses.
In January 2026, the automotive research and car-shopping platform Edmunds was listed by the ShinyHunters hacking group as having been breached. Data purportedly obtained in the incident was later published publicly and included 178k unique email addresses, usernames, passwords, IP addresses, phone…
On 24 January 2026, France's underwater diving federation FFESSM disclosed a personal-data breach after unauthorised access to one of its IT systems exposed identity and contact details of members and licence holders, with roughly 950,000 people affected and data offered for sale on the dark web.
On 24 January 2026, a customer database from French silver-jewelry brand Guiot de Bourg covering some 90,000 e-commerce accounts surfaced online, exposing names, emails, dates of birth, hashed passwords and order/payment metadata.
Customer data from French vehicle-rental company Movida was exposed in a breach disclosed on 24 January 2026, including names, contact details and bank account numbers (IBANs).
On 24 January 2026, a database attributed to French bank-comparison and credit-brokerage service Panorama Banques (Panorabanques) surfaced online, exposing personal, contact and detailed financial-profile data on roughly 2.34 million customers.
On 23 January 2026, the French Fencing Federation (FFE) had its licensee database leaked as part of a wave of attacks on French sports federations, exposing members' names, contact details, postal addresses, nationality and licence/club information.
On 23 Jan 2026 the Fédération Nationale des Chasseurs disclosed a breach of its hunting-permit validation portal, exposing names, dates of birth, postal/email addresses, phone numbers, federal IDs and licence details of roughly 1.4 million hunters.
The French Volleyball Federation (FFVolley) confirmed a breach of its membership database affecting roughly 1.2 million licensees, with about 23 GB of highly sensitive files — including national ID cards, passports and birth certificates — exfiltrated and offered for sale.
On 23 January 2026, the French Firefighters Federation suffered a data breach exposing the personal records of roughly 822,449 firefighters, including names, email addresses, phone numbers and postal addresses.
On 23 January 2026, a customer database from French frozen-food home-delivery company Grand Froid (Saint-Nabord, Vosges) surfaced online, exposing customers' names, postal addresses and order dates.
In January 2026, a database from the French real-estate network Orpi's owner/tenant extranet surfaced online, exposing names, postal addresses, IBANs, rent receipts and extranet logins with passwords stored in plain text.
On 23 January 2026, a threat actor claimed to have leaked the database of Scoring.fit, a French fitness-competition management platform, exposing personal data tied to roughly 83,000 athletes, clubs and volunteers registered for events.
On 23 January 2026, a data leak attributed to Too Easy was reported, exposing customer personal data including names, email addresses, phone numbers and IP addresses. The full scale of the incident has not been publicly confirmed.
Disclosed on 23 January 2026, a leak from Valorissimo — the French B2B new-build real estate marketplace owned by Bouygues Immobilier — exposed account data of platform users, including logins, email addresses, names, phone numbers, postal addresses and company affiliations.
In January 2026, French crypto-tax platform Waltio disclosed a breach exposing data from around 50,000 users — email addresses and 2024 tax-report summaries (gains/losses and year-end balances) — followed by an extortion attempt the company refused to pay.
Current and former licence holders of the French Golf Federation (ffgolf) are affected by a confirmed leak involving more than 1.2 million records. The leak comes from the central database of...
In January 2026, the French National Hunters Federation (FNC) and the French Office for Biodiversity (OFB) suffered linked data breaches exposing personal data of roughly 1.4 million hunting-permit holders, with a 27 GB dataset offered for sale on the dark web.
Around 822,499 members of France's National Firefighters Federation (FNSPF) had their personal data exposed in a January 2026 leak tied to a wider campaign of French federation breaches, with names, dates of birth, postal and email addresses and phone numbers harvested and resold on underground forums.
Customers of Babyvista, a maternity photography service, are affected by a data leak impacting nearly 3.7 million people. The leak, initially dated 15/03/2025, covers…
On 21 January 2026, French engineering grande école ENSAM (Arts et Métiers) disclosed a personal-data breach resulting from external malicious activity, exposing students' names, social security numbers, scholarship decisions and amounts, and work-stoppage dates; the total volume was not specified.
ENSAM, a French public engineering school (Arts et Métiers), reported a data breach caused by a malicious external act, exposing students' names, social security numbers, scholarship award decisions and amounts, and sick-leave dates.
On 20 January 2026, a data leak affecting ConseilJuridique.net — a French online legal-consultation platform connecting individuals with lawyers — was reported, exposing customer account data; the precise scale and exposed fields were not publicly detailed.
Delko, a French automotive repair and spare-parts franchise network, was hit by the Sinobi ransomware group around December 2025; the gang published the company on its leak site on 5 January 2026, with the claim relayed to affected customers and publicly on 20 January 2026.
A January 2026 cyberattack on France Éducation International's GAEL platform exposed civil-identity data of roughly 5.8 million DELF-DALF exam candidates and diploma holders since 2005, after attackers used compromised external user credentials.
On 20 January 2026, a database of around 108,000 customers of French mobile virtual operator Syma Mobile was offered for sale on a dark-web forum, exposing names, dates of birth, postal and email addresses, phone numbers and copies of identity documents.
In January 2026, Info Jeunes Bourgogne Franche-Comté, the regional youth information service running the Carte Avantages Jeunes, had identity data on some 282,906 cardholders stolen and offered for sale on the dark web; exposed fields were limited to identification and contact details.
On 19 January 2026, France's Urssaf disclosed fraudulent access to its DPAE pre-hire declaration API via a compromised partner account, exposing the names, dates of birth, employer SIRET and hire dates of around 12 million employees hired in the past three years.
The 46,506 people linked to Pix Orga are reportedly affected, according to the claim, mainly pupils and teaching team members. The Pix Orga service, used by institutions…
A data set tied to TooEasy Agence Web, a French web and digital agency based in Valence, was put up for sale on a dark web forum, exposing roughly 90,726 unique email addresses along with client names, phone numbers and recruitment records.
In January 2026, sportswear brand Under Armour was hit by a data leak after the Everest ransomware gang published roughly 72.9 million stolen customer records online, including about 6.7 million people in France, exposing names, emails, dates of birth and purchase history.
On 17 January 2026, a threat actor advertised a database allegedly stolen from French office-supplies and IT retailer iOBURO, claiming 93,746 customer records were exposed; the claim remains unverified by the company.
A January 2026 claim alleges that data on members of AAPPMA Le Bambou Castillonnais (Castillon-la-Bataille, Gironde) was exposed through the national Cartedepeche.fr angling platform, with around 9,599 records said to be affected following a breach the FNPF disclosed in early 2026.
On 17 January 2026, a threat actor claimed to have leaked a Wobz (formerly Dalvin) customer database of about 134,209 records, exposing customer and corporate names, email addresses, internal security keys and GoCardless payment identifiers.
StorePasCher customers are affected by a claimed leak involving 43,366 accounts, according to the claim. The case concerns the e-commerce site StorePasCher, which offers online sales…
On 15 January 2026, a leak exposed the personal data of 598 people linked to the Paris Departmental Union of the Force Ouvrière trade union (UD 75), reportedly stemming from an export batch pulled from the union's membership management system.
Employees of Groupe Fondasol are affected by a claimed data leak covering 888 profiles, according to the claim. The engineering firm in the construction sector works on projects in…
LBP Granville customers are reportedly affected by a data leak, according to the claim. The announced volume exceeds 3.6 million records and a sale is mentioned for January 15…
On 15 January 2026, French children's and educational book publisher Lire Demain (Auzou group) suffered a data breach exposing the personal details and order history of around 4,616 customers.
In January 2026, Eurail B.V. — operator of the Interrail and Eurail rail-pass schemes — disclosed a data breach exposing personal and passport details of customers, with up to ~309,000 travellers reportedly affected and stolen data later offered for sale on the dark web.
The Akira ransomware group listed French roller-shutter component manufacturer Zurflüh-Feller as a victim in early 2026, threatening to publish around 66 GB of stolen corporate data, including employee identity documents, financials, contracts and NDAs.
On 12 January 2026, French streetwear and sneaker retailer Blackstore had a customer database leaked exposing the personal and order details of 101,979 people, including names, email addresses, phone numbers, store locations and order records.
In January 2026 a dataset of about 17.5 million Instagram records — usernames, full names, email addresses, phone numbers and partial location data — went up for sale on a dark-web forum, reportedly harvested via a 2024 API scraping leak.
Breach of the MonLogicielMedical (MLM) practice software by Cegedim Santé, disclosed to affected doctors in early January 2026, exposing patient administrative records — name, date of birth, address, social-security scheme — for up to 11–15 million patients via compromised doctor accounts.
Users of the adult sites nephael.net and chloesanchez.com are affected by a confirmed data leak involving around 65,000 accounts. According to the elements published, the…
Customers and recipients who used Relais Colis are affected by a confirmed leak impacting nearly 9.5 million records. The volume announced is 9,526,266 rows, and a claim…
On 10 January 2026, a threat actor claimed a data leak at French digital agency ACRV.FR, alleging it had exfiltrated archives and databases tied to several client sites the agency hosts or maintains; the claim is unverified and the scale is unconfirmed.
Customers of Audiophonics.fr are reportedly affected, according to the claim, by a leak involving a database announced at around 115,000 users. The site targeted is an online shop…
A database from the cybercrime forum BreachForums leaked online, exposing roughly 324,000 user accounts — email addresses, usernames, Argon2 password hashes, IP addresses, forum posts and private messages — after a backup was left in an unsecured folder in August 2025.
Panorabanques.com customers are affected by a confirmed leak affecting around 2.34 million people. The financial comparator, used by individuals to compare offers…
On 10 January 2026, a threat actor advertised on BreachForums a database allegedly stolen from French home-respiratory-care provider SOS Oxygène, claiming roughly 146,605 unique patients with names, full postal addresses and GPS coordinates exposed.
Accounts linked to Apec Région Occitanie (Montpellier / Nîmes / Toulouse) are reportedly affected by a leak, according to a claim on Breachforums that mentions a scope of around 3,000 profiles. To…
In January 2026, the automated investment platform Betterment confirmed it had suffered a data breach attributed to a social engineering attack. As part of the incident, Betterment customers received fraudulent crypto-related messages promising high returns if funds were sent to an…
Students and teachers of Euronature (School of Naturopathy) are affected by a confirmed data leak. According to the estimate, around 7,761 people would be exposed; the corpus released…
On 9 January 2026, the campaign website of Paris mayoral candidate Sarah Knafo (Reconquête) publicly exposed the personal data of hundreds of contributors to its 'Paris à cœur ouvert' forum, including names, emails, phone numbers and IP addresses, even for people who had asked to stay anonymous.
Young holders of the Carte Avantages Jeunes (CRIJ Bourgogne-Franche-Comté) are affected by a confirmed leak impacting nearly 283,000 people. The published elements include, according to the…
In January 2026, the Casino de Paris music hall confirmed a data leak affecting roughly 111,000 customers, with names, email addresses and postal locations (city and zip code) exposed after a database appeared for sale on a hacker forum.
Corse GSM, Corsica's independent mobile and internet operator, was hit by a data leak disclosed on 8 January 2026 exposing roughly 23,920 customer records, including names, postal addresses, phone numbers and banking details (IBAN/BIC).
On 8 January 2026, a database of 262,925 licensed members of the French Bridge Federation (FFB) was claimed on a hacker forum, exposing names, dates of birth, postal and email addresses and phone numbers as part of a wider wave of attacks on French federations via a shared IT provider.
Licence holders of the French American Football Federation (FFFA) are affected by a claimed leak said to target 200,415 records. According to the claim, the corpus would contain...
In January 2026 the French Federation of Mountaineering and Climbing (FFME) disclosed a data breach in which a fraudulently used member account gave illegitimate access to contact data — names, dates of birth, addresses, licence types — for its licence holders, a leak tracked at 561,502 records.
In January 2026, the Fédération Sportive et Gymnique du Travail (FSGT), a French workers' multisport federation, was hit by a claimed data leak exposing the personal records of its licence holders, with the claim referencing a database of roughly 600,000 accounts.
A threat actor put a customer database stolen from second-hand retailer EasyCash up for sale on a hacking forum, exposing roughly 14 million records — names, dates of birth, postal addresses, phone numbers and email addresses — apparently extracted via a compromised internal/partner account.
On 7 January 2026, a database of the French Canoe-Kayak Federation (FFCK) holding 31 years of member records was leaked, exposing the personal data of 393,374 members, including 392,892 postal addresses, 212,342 phone numbers and 158,434 unique emails.
Roughly 600,000 licence holders of France's Roller and Skateboard Federation (FFRS) had their personal data exposed after the Rolskanet membership-management platform run by a shared third-party provider was breached, leaking names, contact details, and birth information.
On 7 January 2026 a leak claim surfaced alleging the theft of a 162,263-row database of French Squash Federation (FFSquash) licence holders, part of a wider wave of attacks on French sports federations exposing members' personal data.
In January 2026, Panera Bread suffered a data breach that exposed 14M records. After an attempted extortion failed, the attackers published the data publicly, which included 5.1M unique email addresses along with associated account information such as names, phone numbers and physical addresses.
On 8 January 2026 the French Microlight Federation (FFPLUM) disclosed that an attacker had fraudulently accessed an administrator account on its licence-management platform, exposing the personal data of roughly 78,000 members, including names, dates of birth, postal addresses, emails and phone numbers.
On 6 January 2026 a data leak claimed against the French Twirling Baton Federation (FFTwirl) exposed the personal records of around 52,785 licence holders, volunteers and officials, including names, postal and email addresses, phone numbers, birth dates and club affiliations.
In early January 2026, a member database of the Fondation des Lions de France (Lions Clubs of France) was published on BreachForums, exposing 133,297 deduplicated individuals — including full civil status, home addresses, phone numbers and profile photos — in a leak traced to the MyAssoc club-management platform.
Managers and operators of about 600 L'Orange Bleue clubs are reportedly affected by an internal data leak dating back to June 2025, according to the claim. A public sample analyzed includes…
On 6 January 2026, a database of 5,304 customers of the Paris hair salon Loft by Denis (rue des Moines) was published on BreachForums, exposing names, mobile numbers, email addresses, visit counts and profile timestamps.
On 6 January 2026, a database from the Philharmonie de Paris's 'Philharmonie à la Demande' (PAD) music platform was published online, exposing 47,561 accounts — names, email addresses, logins and professional profiles — in a leak claimed by an actor known as HexDex2.
French engineering consultancy DCE Conseil suffered a breach after an employee's cloud account was compromised with stolen credentials, exposing roughly 844 GB of sensitive technical files — including plans of prisons, a military base and luxury and corporate clients — later offered for sale on BreachForums.
Ledger customers are affected by a data leak confirmed by the Global-e provider. The number of impacted customers has not been publicly disclosed.
In early January 2026, France's immigration and integration agency OFII disclosed a breach traced to a subcontractor handling integration-contract language courses; attackers exposed identity, contact and immigration-status data on foreign residents and advertised 2.1 million records for sale.
On 5 January 2026, French home-care franchise network Petits-fils confirmed a data leak exposing roughly 1,050 identities of staff and collaborators across its network of agencies and franchises.
In early January 2026, staffing agency Adecco was hit by a data leak after a threat actor put a database of roughly 800,000 candidate profiles — including about 750,000 CVs with names, contact details and work histories — up for sale, claiming extraction from an internal Adecco tool.
In January 2026, AgroParisTech — France's leading graduate school of agronomy and life sciences — suffered a cyberattack in which an intruder claimed to have exfiltrated around 211 GB of data, exposing HR and personal records of staff, students and external contributors.
AXYON customers and partners are affected by a claimed leak said to involve around 340 GB of internal data, according to the claim. AXYON provides B2B engineering services…
In early January 2026, the LAPSUS$ group publicly leaked around 40 GB of data extracted from 54 client SQL databases managed by French web agency Dream Up (dream-me-up.fr), exposing customer and contact information from the e-commerce and showcase sites it hosts.
On 2 January 2026, a data leak was claimed against AFPPCD-IDF, a Paris-based dental-assistant training association, exposing personal records on roughly 24,000 trainees including names, dates and places of birth, contact details and French social-security (NIR) numbers.
On 2 January 2026, a dark-web forum member claimed to be selling an internal Trescal customer database of roughly 70,981 unique records, exposing names, business emails, phone and fax numbers, job titles, company names and French SIRET numbers.
On 1 January 2026, a database of around 2.1 million records belonging to France's OFII / ANEF "Étrangers en France" immigration portal was put up for sale on BreachForums, exposing foreign nationals' identities, contact details, family situation and residence-permit data after a subcontractor was compromised.