8 mins read
The short version
An unofficial forum index claims to catalog 131 active France-related datasets totaling 279,746,410 records. That figure should not be read as 279.7 million different victims. One person may appear many times, a single account may generate multiple rows, collections may overlap, and several large entries are scrapes or lawful open data rather than security breaches.
The confirmed incidents are serious. The French data protection authority, the CNIL, said the March 2024 France Travail intrusion could have exposed data relating to as many as 43 million people. In October 2024, attackers accessed data relating to more than 24 million Free and Free Mobile subscriber contracts. Other independently documented incidents affected Bouygues Telecom, Boulanger, Cultura, LDLC, Sport 2000, Shadow, Le Slip Français, Zadig & Voltaire, Bourse des Vols, Short Édition, Pokébip, Domino's France and Belgium, the Fédération Française de Rugby, and Dedalus medical-laboratory patients.
The practical lesson is not that every French website is unsafe. It is that identity data has become highly reusable. A name, address, email address, phone number, date of birth, customer history, social-security number, or IBAN may be harmless in isolation, but combinations of those fields can make phishing, impersonation, account recovery abuse, and payment fraud far more convincing.
What the numbers mean—and what they do not
The supplied index uses four labels:
Database (D): A file claimed to have come from an organization's database. This is not proof by itself that the organization was breached.
Scrape (S): Information collected from webpages, APIs, profiles, public registers, or other viewable sources. Scraping can violate a site's terms or privacy law, but it is not automatically a hack.
Collection (C): Multiple datasets combined. Collections often contain duplicates and previously circulated material.
Record, user, or email count: A row count, estimated account count, or count of unique email addresses. These measurements are not interchangeable.
There are also three important evidence levels in this article:
Confirmed: Supported by the affected organization, a regulator, or a reputable breach-verification service.
Corroborated but disputed in scale: The incident is real, but public sources disagree about the number of rows, unique accounts, or affected people.
Alleged/forum-only: The supplied index makes the claim, but no reliable public source was located that confirms the origin or exposed fields. For these entries, the correct answer to "what data was stolen?" is not publicly confirmed.
The largest confirmed French incidents in context
France Travail: job-seeker identity data
On March 8, 2024, France Travail and Cap emploi notified the CNIL of an intrusion. The regulator initially said as many as 43 million current and former job seekers and candidate-account holders could be affected. The exposed fields included names, social security numbers, France Travail identifiers, email and postal addresses, and phone numbers; passwords and bank details were not reported as affected. In January 2026, the CNIL fined France Travail €5 millionover security failures connected with the incident.
The supplied 131-entry index contains two different France Travail items: a 10.2 million-record dataset dated 2022 and a roughly 302,000-record dataset with no date. The first appears consistent in scale with the separate 2023 Majorel/Pôle emploi incident, in which names, job-seeker status, and social-security numbers were reported affected, but contact details, passwords, and banking information were reportedly not. The second cannot be confidently matched to a public incident from the index alone.
Free and Free Mobile: contact data and IBANs
The CNIL found that an attacker exfiltrated data relating to 24,633,469 fixed and mobile contracts beginning in October 2024. Depending on the subscriber record, exposed information included identity and contact details, contract data, and IBANs. In January 2026, the CNIL imposed combined fines of €42 million on Free and Free Mobile.
Have I Been Pwned (HIBP) later indexed approximately 13.9 million unique email addresses in the publicly circulated data and listed names, physical addresses, phone numbers, gender, dates of birth, and, in many records, bank account numbers. The forum index's separate 19.2 million-record Free item is labeled a scrape, so it should not automatically be treated as the same dataset or added to the official victim total.
Bouygues Telecom: customer and bank-account details
Bouygues Telecom disclosed an August 2025 cyberattack affecting about 6.4 million customer records. HIBP identified about 5.7 million unique email addresses and listed names, postal addresses, phone numbers, dates of birth, and IBANs among the exposed fields. Bouygues said affected customers were notified.
Boulanger, Cultura, Truffaut, and delivery-related customer records
French retailers experienced a wave of incidents in September 2024. Boulanger's circulated data contained roughly 2.1 million unique email addresses within a much larger set of rows, plus names, phone numbers, physical addresses, and geographic coordinates. Claims of more than 27 million rows did not mean 27 million unique customers.
Cultura said an external IT provider affected about 1.5 million customers. Exposed data included names, Cultura customer IDs, mobile numbers, email and postal addresses, and purchased-product information. Truffaut was also named in the same wave, but the supplied index's specific 2025 dataset and its field list remain unconfirmed.
Retail, travel, gaming, publishing, and sports breaches
Several other entries have field-level corroboration:
Sport 2000 (April 2024): About 3.2 million unique email addresses, with names, postal addresses, phone numbers, dates of birth, salutations, and purchases linked to store names.
LDLC (February 2024): About 1.26 million unique email addresses, with names, phone numbers, postal addresses, and salutations.
Le Slip Français (April 2024): About 1.5 million email addresses, with names, phone numbers, and postal addresses.
Zadig & Voltaire (incident dated November 2023): About 586,895 email addresses, with names, gender, phone numbers, and postal addresses.
Shadow (September 2023): About 543,295 accounts, with names, dates of birth, email addresses, and postal addresses.
Bourse des Vols (January 2021): About 1.46 million email addresses, with names, dates of birth, phone numbers, IP and postal addresses, flights taken, and purchases.
Short Édition (June 2021): About 505,000 records, including names, usernames, dates of birth, gender, email and postal addresses, phone numbers, social profiles, and salted password hashes.
Pokébip (July 2015): About 657,000 identities, including email and IP addresses, usernames, site activity, time zones, and unsalted MD5 password hashes.
Domino's France and Belgium (June 2014): About 648,000 customers, including names, email and postal addresses, phone numbers, and weakly hashed passwords.
Fédération Française de Rugby (June/July 2023): About 282,000 unique email addresses, with names, dates of birth, and phone numbers. The supplied index's 334,135-row count likely measures rows rather than unique email addresses.
Dedalus laboratory records (2021): Data relating to nearly 500,000 patients, including identity and contact details as well as medical conditions, pregnancy status, and treatment information. The CNIL imposed a €1.5 million fine in 2022.
Verified supplemental incidents outside the original 131-entry index
The additional material submitted for this update named 234 organizations but did not provide citations, record counts, incident notices, or exposed-data fields. Naming an organization in a list is not evidence of a breach, so the article does not publish those claims as fact. The following four additions are included because French regulators or government bodies have publicly corroborated them.
Viamedis and Almerys - January 2024 - more than 33 million people
The two third-party healthcare-payment operators notified the CNIL of attacks in late January 2024. Compromised data included civil-status information, dates of birth, social-security numbers, health-insurer names, and subscribed contract guarantees for insured people and family members. The CNIL said bank details, medical data, reimbursement histories, postal addresses, phone numbers, and email addresses were not believed to be affected.
ANTS / France Titers - April 2026 - approximately 11.7 million accounts
France's Ministry of the Interior confirmed an incident involving personal and professional accounts on ants.gouv.fr. Potentially exposed consumer-account fields included login identifiers, salutations, names, email addresses, dates of birth, unique account identifiers, and, when present, postal addresses, places of birth, and phone numbers. The ministry said submitted attachments and biometric data were not exposed.
Direction générale des Finances publiques (DGFiP) - June and July 2026
France's Finance Ministry said stolen public-employee credentials enabled unauthorized consultation and extraction of some individual and professional records. Potentially viewed information included tax identifiers, civil status, postal, telephone, and email details, family and dependent information, reference taxable income, withholding-tax rates, and messages exchanged through impots.gouv.fr. The ministry said the personal and professional online tax spaces were not compromised.
Ministry of National Education - July 2026 - scope still under investigation
The ministry confirmed a July 25 intrusion and possible exfiltration of personal data, notified potentially affected staff, and said it was investigating later claims involving student records. As of the August 18 update, the exact scope and student data fields had not been established publicly. The article therefore records the confirmed intrusion without repeating unverified criminal claims about victim totals or fields.
Complete review of the 131 active entries in the supplied France index
The dates and counts below reproduce the supplied index's claims unless a note says otherwise. "Unknown" means the source did not publish a trustworthy field list; it does not mean the dataset contained no personal information.
Entries 1–25
Entries 26–50
Entries 51–75
Entries 76–100
Entries 101–131
The 131 France Datasets
Complete review of the 131 active entries in the supplied France index
The dates and counts below reproduce the supplied index's claims unless a note says otherwise. "Unknown" means the source did not publish a trustworthy field list; it does not mean the dataset contained no personal information.
1. Influentia - 2021 - 49,805,401 claimed users - scrape.
The index describes a scrape of Instagram influencer accounts associated with Influentia. No verified field list is supplied; because it is labeled a scrape, the safest description is public or viewable profile data rather than a confirmed intrusion into Influentia.
2. Décès en France - 1970-2025 - 28,498,095 claimed people - scrape/open data.
This appears to derive from INSEE's public register of deceased persons, which contains civil-status facts such as names, sex, birth details, death date, and place. Republishing or enriching open data can create privacy and fraud risks, but this entry is not evidence that deces-en-france.fr or INSEE was hacked.
3. Facebook, French extract - incident dated 2019; circulated in 2021 - 19,848,557 claimed French rows - confirmed global scrape/exposure.
The wider dataset associated phone numbers with identities and commonly included names and gender; many records also included date of birth, location, relationship status, or employer, while relatively few contained email addresses. This is a country extract of a global Facebook incident, not a breach of a French website.
4. Free.fr - 2024 - 19,192,947 claimed users - scrape.
The index explicitly labels this item a scrape and gives no reliable field list. Do not conflate it with the separately confirmed October 2024 Free/Free Mobile breach, which involved more than 24 million contracts and included identity, contact, contract, and, in some cases, IBAN data.
5. JKAmaret - 2024 - 19,172,852 claimed email addresses - alleged database.
The index attributes the material to a digital-marketing company but provides no operator disclosure or independently verified field list. Email addresses are implied by the count method; any additional fields remain unknown.
6. Mon Logiciel Médical / Cegedim - 2025 - 19,109,298 claimed records - scrape.
The item is labeled a scrape of a healthcare software ecosystem rather than a confirmed Cegedim database intrusion. No dependable field list is provided, and it would be irresponsible to assume medical content without an operator or regulator confirming it.
7. Registre National des Entreprises (RNE) - 2026 - 15,777,446 claimed entities - scrape/open register.
The RNE is France's national business register, so names of business operators, company identifiers, addresses, activities, and filing data may be publicly accessible by law. This entry should be described as repackaged public business data, not a stolen consumer database.
8. Colis Privé - 2025 - 12,463,709 claimed email addresses - scrape.
The index labels this a scrape connected to a delivery company and confirms no other fields. Delivery datasets can be sensitive, but names, addresses, parcel histories, or phone numbers should not be attributed to this file without evidence.
9. Unspecified "ANTS" dataset - 2025 - 12,091,914 claimed users - alleged, unattributed database.
The source itself says the origin is unknown and only claims that the file contains real French data. Because attribution and fields are unverified, it must not be presented as an ANTS breach; ANTS publicly acknowledged a separate official incident in 2026.
10. France Travail / Pôle emploi - data dated 2022; incident reported in 2023 - 10,225,310 claimed people - corroborated in scale.
The likely matching Majorel incident affected around 10 million current or former job seekers and reportedly exposed names, job-seeker status, and social security numbers. Email addresses, phone numbers, passwords, and bank details were reportedly not compromised in that incident.
11. Union Nationale du Sport Scolaire (UNSS) - 2025 - 7,687,552 claimed users - alleged database.
The index asserts a database release involving France's school-sports organization but gives no confirmed data classes. Because children or students could be involved, the lack of a verified field list matters, and no fields should be guessed.
12. Meetic - 2016 - 7,169,560 claimed users - alleged database.
The supplied source lists a dating-service database but offers no independently supported field list. Membership data can be sensitive, so readers should use only a verified breach-notification service for their own address and avoid searching raw dumps.
13. Pass'Sport - 2025 - 6,368,677 claimed email addresses - scrape.
The source says this dataset was incorrectly called "CAF" and instead relates to the government youth-sports aid program. It is labeled a scrape, and the index does not establish which fields beyond email addresses were present or whether any protected system was accessed.
14. Bouygues Telecom - August 2025 - about 6.4 million customer records - confirmed.
Exposed information included names, postal addresses, phone numbers, dates of birth, email addresses, and IBANs. HIBP counted approximately 5.7 million unique email addresses, explaining why row and email totals differ.
15. MYM - 2021 - 5,553,314 claimed users - alleged database.
The index lists a fan-monetization platform database but provides no public confirmation or field inventory. Do not assume account identity, creator status, payments, or content from the listing alone.
16. Boulanger - September 2024 - 5,376,178 claimed users in the index; more than 27 million circulated rows - confirmed incident, disputed measurements.
HIBP identified about 2.1 million unique email addresses plus names, phone numbers, physical addresses, and latitude/longitude. The much larger row totals appear to include multiple records per person, so they should not be reported as unique victims.
17. AUTOSUR - 2025 - 5,224,453 claimed users - alleged database.
The index attributes a database to the vehicle-inspection network but discloses no reliable fields. Vehicle, inspection, identity, contact, or registration details remain possible only in theory and must not be stated as fact.
18. Easy Cash - 2024 - 4,800,558 claimed users - alleged database.
The source identifies a second-hand retail database without an operator notice or trustworthy field list. The record count is a forum claim and may include transactions, duplicate customer rows, or non-personal operational data.
19. French sports federations collection - date unknown - 3,277,687 claimed email addresses - collection.
The source says it combines FFBadminton, FFBasket, FFBoxe, FFDanse, FFKickBoxing, FFHockeyGlace, FFHockey, FFVolleyBall, FFEPGV, FSCF, FFMoto, FFHandball, FFTir à l'Arc, FFTennisTable, and FFNatation datasets. Email addresses are implied, but the dataset does not provide a common field list or independent confirmation for every federation.
20. Zen Mobile / WebRivage - 2023 - 3,238,776 claimed users - alleged database.
The entry concerns a mobile-advertising business and may therefore involve marketing records, but the source does not verify any field beyond its user count. Names, devices, ad identifiers, locations, or consent records should not be asserted without corroboration.
21. Sport 2000 - April 2024 - 3,217,146 claimed email addresses - confirmed.
The dataset contained about 3.2 million unique email addresses within 4.4 million rows, plus names, postal addresses, phone numbers, dates of birth, salutations, and purchase information tied to store names. This is one of the index's best-corroborated entries.
22. HelloWork - 2025 - 2,864,136 claimed users - alleged database.
The index attributes a dataset to the employment platform but offers no public field inventory. Job-seeker profiles can contain detailed career information, yet no such field should be claimed unless HelloWork or an independent verifier confirms it.
23. Fitness Park - 2025 - 1,991,490 claimed users - scrape.
Because the item is labeled a scrape, it may reflect data collected through exposed pages or interfaces rather than a stolen core database. The source supplies no reliable list of names, contact details, memberships, or payment information.
24. Réduction-Impôts.fr - 2024 - 1,927,077 claimed users - alleged database.
The business operates in wealth-management advice, which makes the claim potentially sensitive, but the index does not identify exposed fields. Financial circumstances, tax data, contact details, and lead information must all be treated as unconfirmed.
25. SFR - October 2024 - 1,922,388 claimed users - alleged forum dataset.
SFR separately acknowledged a September 2024 incident involving names, contact and delivery details, subscribed offer/order details, IBANs, and, in relevant mobile orders, terminal and SIM identifiers. The index alone does not establish whether this 1.92 million-row file is that same incident, a later compilation, or a duplicate.
26. French websites collection - 2025 - 1,654,111 claimed email addresses - collection.
The index says this combines data attributed to lbm-distribution.com, sokaifrance.com, hook-up.eu, devilfrog-official.com, selm.fr, girouette.fr, cinelleparis.com, espritdecuisine.fr, mototbc.com, affairegroup.com, un-chat-sur-un-fil.fr, elevage-passion.fr, antiquitesdugolfe.com, atlas-fan.fr, asafan.fr, insectes-food.com, ardoneo.com, tresors-du-passe.fr, marine-impact.com, bijouterie-malgat.com, antiqu-arts.com, foodtechnologyfrance.com, portes-et-quais.fr, sailteck.com, solary-stores.com, taktic.fr, placedauphine.fr, cc-sud.eu, protoit.fr, did-brumisation.fr, leteuff.eu, chateaudelannouan.fr, solufi-ouest.fr, lecotesecret.fr, blmsudbretagne.fr, fnnv.fr, opti-elec.fr, vulcain-verre.fr, eolurba.fr, and cap-au-naturel.fr. Email addresses are implied; no standardized field list or confirmation from every named site is supplied.
27. Le Slip Français - April 2024 - 1,495,127 email addresses - confirmed.
HIBP lists email addresses, names, phone numbers, and physical addresses in the breach. The index calls it a scrape, but independent breach reporting supports describing the incident as unauthorized exposure.
28. LDLC - February 2024 - 1,467,144 claimed emails; 1,266,026 unique emails in HIBP - confirmed.
Exposed fields included names, email addresses, phone numbers, postal addresses, and salutations, primarily involving physical-store customers. The differing totals likely reflect duplicate rows or different cleaning methods.
29. Rinaorc - 2022 - 1,463,239 claimed users - alleged database.
The source describes a French Minecraft server database but gives no confirmed field list. Gaming databases commonly contain usernames, emails, IP addresses, or password hashes, but without evidence, those fields cannot be attributed to this incident.
30. Bourse des Vols - January 2021 - 1,460,703 claimed users - confirmed.
Documented data included names, dates of birth, email, phone, IP, and physical addresses, purchases, and flights taken. Travel histories can make impersonation and targeted scams much more convincing.
31. Mutuelle des Motards - 2025 - 1,338,105 claimed users - alleged database.
The index attributes the data to a motorcycle insurer but does not confirm fields. Identity, policy, vehicle, claims, contact, or banking information should not be assumed from the record count.
32. SFR - June 2024 - 1,319,207 claimed users - alleged forum dataset.
This is one of several SFR entries in the index, creating a substantial risk of double-counting. The source provides no field list that uniquely ties this file to an acknowledged SFR incident.
33. Cultura - September 2024 - 1,219,263 claimed emails in the index; about 1.46 million unique emails in HIBP - confirmed.
Cultura reported names, customer identifiers, mobile numbers, email and postal addresses, and purchased-product information. It attributed the attack to an external IT provider and notified affected customers.
34. Elite Auto - 2025 - 1,063,473 claimed users - alleged database.
The index lists an auto-dealer database without a corroborated field list. Customer identity, contact, vehicle, quote, finance, or order details remain unconfirmed.
35. Chronopost Pickup - 2025 - 861,084 claimed users - alleged database.
The source associates the file with the parcel-pickup service but supplies no reliable fields. Names, phone numbers, addresses, parcel identifiers, and pickup locations are plausible in such systems but must not be reported as exposed facts.
36. Jassume - 2021 - 792,208 claimed users - alleged dating database.
No independent notice or field list is supplied. Because participation in a dating service is sensitive, checking must be private and based on proof of control over one's own email address.
37. Pajemploi - 2025 - 689,415 claimed users - alleged database.
The service connects parents and childcare workers and is hosted within the Urssaf ecosystem, but the index alone does not prove an Urssaf compromise. Treat identity, employment, child, payment, and social-contribution fields as unknown.
38. Lycamobile - 2025 - 688,375 claimed users - alleged database.
The index gives no verified field inventory. Subscriber names, phone numbers, SIM data, account identifiers, and contact details should not be attributed without a company or regulator notice.
39. Pokébip - July 2015 - 657,001 users - confirmed.
Exposed data included usernames, email and IP addresses, time zones, website activity, and passwords stored as unsalted MD5 hashes. Anyone who reused a 2015 password should change it everywhere it was reused.
40. Domino's France and Belgium - June 2014 - 648,231 users - confirmed.
Exposed data included names, email and postal addresses, phone numbers, and weakly hashed passwords. The age of the breach does not eliminate risk if contact details or reused credentials remain current.
41. Portail Emploi - 2025 - 611,698 claimed users - scrape.
The listing is a scrape of a job-search site, not a confirmed system intrusion. The source does not say whether it contains only public vacancy data or also personal profile/contact information.
42. Fédération Française de Roller & Skateboard - 2025 - 599,797 claimed users - scrape.
The index labels this a scrape and provides no field list. Federation, club, results, or licensee information may include public records, but personal contact details cannot be inferred.
43. Zadig & Voltaire - incident dated November 2023; posted June 2024 - 586,895 emails - confirmed.
Exposed fields included names, gender, email addresses, phone numbers, and physical addresses. The brand reportedly said the incident occurred more than six months earlier and that it took action quickly.
44. Bounty Chat - 2025 - 570,056 claimed users - alleged dating database.
The source gives no independently confirmed field list. Membership and communications could be sensitive, but neither should be asserted based only on a forum index.
45. Winamax - 2022 - 563,659 claimed users - alleged database.
The index attributes a dataset to the betting operator but does not disclose fields or confirm the operator. Treat account, wagering, payment, identity-verification, and self-exclusion information as unconfirmed.
46. Jeux-Fille-Gratuit - 2018 - 561,492 claimed users - alleged database.
The source lists a children-oriented gaming website database without a verified field list. The possibility of minors makes careful language and private verification essential.
47. Shadow - September 2023 - 543,295 emails - confirmed.
The cloud-gaming breach exposed names, dates of birth, email addresses, and physical addresses. Passwords were not among HIBP's listed data classes for this incident.
48. La Poste Mobile - July 2022 - 533,886 claimed email addresses - confirmed cyberattack; precise dump fields not fully established here.
La Poste Mobile publicly acknowledged a July 4 cyberattack, and European threat reporting associated it with LockBit. Readers should rely on the notification they received from the operator for their exact affected fields rather than assuming the forum file is complete.
49. Coriolis - 2025 - 515,926 claimed users - scrape.
The index labels this a scrape even though it describes the item with breach language. No independently verified fields are supplied, so subscriber identity, contact, contract, or payment data should not be stated as exposed.
50. Short Édition - June 2021 - 505,466 users - confirmed.
Exposed information included names, usernames, dates of birth, gender, email and physical addresses, phone numbers, social-media profiles, and salted SHA-1 or SHA-512 password hashes. Short Édition self-submitted the affected data to HIBP.
51. Murfy - 2025 - 497,647 claimed users - alleged database.
The home-appliance repair company is named, but the index supplies no public confirmation or fields. Contact details, service addresses, appliance records, bookings, and payments remain unverified possibilities, not facts.
52. Dedalus medical-laboratory records - February 2021 - 491,842 rows in the index; nearly 500,000 patients confirmed - confirmed.
The CNIL reported names, dates of birth, postal and email addresses, phone numbers, medical conditions, pregnancy status, and treatments. Because it involved health data, this entry carries unusually high risks of discrimination, blackmail, and targeted fraud.
53. SFR "OSIRIS" - 2025? - 490,153 claimed users - alleged database.
The item's date, source system, and fields are uncertain. Do not merge it with other SFR incidents or describe it as containing any particular subscriber or network data without evidence.
54. Clin-d'Oeil - date unknown - 459,861 claimed users - alleged database.
The index attributes the data to an optician business but provides no corroborated fields. Prescription, health, purchase, identity, and contact information must not be assumed.
55. Grenoble École de Management - 2024/2025 - 448,002 claimed users - alleged database.
No reliable public field list accompanies the forum claim. An education system may include students, applicant, alumni, staff, academic, or payment records, but the index confirms none.
56. Fédération Sportive et Gymnique du Travail - 2025 - 412,004 claimed users - scrape.
The entry is expressly labeled a scrape. Public club, result, event, or licensee information may be involved, but no protected-system intrusion or personal-field inventory is established.
57. NationsGlory - 2022 - 399,069 claimed users - alleged database.
The index identifies a French Minecraft server and no data fields. Usernames, emails, IP addresses, and password hashes are common in gaming incidents but cannot be claimed here without corroboration.
58. L'Assurance Retraite - 2024 - 375,759 claimed users - alleged database.
The national pension system is named, but the source provides no verified incident notice or fields. Social security, pension, identity, contact, employment, or banking information should not be attributed from this listing alone.
59. Maxance - 2024 - 348,345 claimed users - alleged database.
The index describes an insurance-broker file without a reliable field list. Identity, policy, quote, claims, vehicle, contact, and banking data remain unconfirmed.
60. Hôpital Européen de Paris - 2025 - 338,081 claimed users - alleged database.
The forum claim does not establish whether the rows are patients, contacts, appointments, billing records, or something else. No health data should be said to be exposed without confirmation from the hospital, regulator, or victims' notices.
61. Fédération Française de Rugby - June/July 2023 - 334,135 claimed users; 281,977 unique emails in HIBP - confirmed.
The breach exposed names, email addresses, dates of birth, and phone numbers. The federation said the attack primarily affected email servers, and the difference in totals likely reflects measurement and duplicate rows.
62. France Travail - date unknown in the index - 302,313 claimed users - alleged database.
A separate 2025 Kairos incident reportedly affected roughly 340,000 job seekers and included names, postal and email addresses, phone numbers, France Travail identifiers, and other training-related data. The index does not provide enough evidence to prove this 302,313-row file is the same incident.
63. Home Design 3D - 2025 - 300,463 claimed users - alleged database.
The source names an interior-design application but does not verify fields. Do not attribute account identifiers, email addresses, projects, device data, purchases, or home layouts without corroboration.
64. Proxiserve - 2025 - 294,638 claimed users - scrape.
The listing concerns a home-services business and is labeled a scrape. It does not establish whether it collected names, addresses, appointment histories, property information, or contact data.
65. Ixob - 2023 - 279,706 claimed users - alleged database.
The household-appliance spare-parts retailer is named, but no field inventory or operator confirmation is provided. Customer contact, address, order, and appliance information remains unverified.
66. Truffaut - 2025 - 277,826 claimed users - alleged database.
Truffaut was publicly named in the September 2024 retailer wave, but the supplied entry is dated 2025 and may represent a separate file, repost, or reprocessing. The index does not establish which fields belong to this specific dataset.
67. Waffle Factory - 2024 - 271,062 claimed users - alleged database.
No confirmed fields accompany the listing. Loyalty, order, store, email, phone, address, or payment data should not be assumed.
68. Taklope - 2022 - 269,477 claimed users - alleged database.
The index attributes a customer database to an e-cigarette retailer but supplies no corroborated field list. Age, product, order, contact, address, or account data remains unconfirmed.
69. Cybertek and GrosBill - 2024 - 241,125 claimed email addresses - scrape.
The index count implies email addresses, but no other fields are verified. The item is labeled a scrape, which should not be described as a confirmed intrusion into either retailer.
70. Europages French clients - date unknown - 205,403 claimed users - alleged database.
The entry may involve business-contact records, but no field list or independent validation is supplied. Company names, professional emails, phones, job titles, and addresses are plausible but not confirmed.
71. Vitalis - 2025 - 202,558 claimed users - alleged database.
The index describes a customer-service provider and offers no dependable fields. It is unclear whether the rows concern consumers, client-company contacts, support tickets, staff, or another population.
72. Alain Afflelou - 2025 - 198,570 claimed users - scrape.
The item is labeled a scrape of an optical retailer. The supplied source provides no evidence of prescription, health, purchase, appointment, or contact fields.
73. Minefield - 2015 - 188,343 claimed users - alleged database.
The source lists a French Minecraft server and no fields. Old usernames, emails, IP addresses, or password hashes could still matter if reused, but their presence is not verified here.
74. Auto-ici - 2025 - 180,783 claimed users - alleged database.
The auto dealer is named, but the inventory field is missing. Customer identity, vehicle interest, quote, financing, address, and contact details remain unconfirmed.
75. Gererseul - 2023 - 173,327 claimed users - alleged database.
Because this is a rental-management application, a real compromise could be sensitive, but the listing supplies no verified fields. Landlord, tenant, property, lease, payment, and contact records must not be inferred.
76. Taobento — 2025 — 170,697 claimed users — alleged database. The index attributes customer data to a restaurant chain but provides no public field list. Loyalty, order, store, contact, address, or payment data remains unknown.
77. Rapid Flyer — 2019 — 166,760 claimed users — alleged database. The printing service is named, but the fields are not corroborated. Customer names, business contacts, addresses, orders, uploaded designs, and invoices should not be stated as exposed.
78. Fédération Française de Squash — date unknown — 162,263 claimed users — scrape. This is labeled a scrape rather than a confirmed breach. The source does not distinguish public rankings or club information from private licensee records.
79. Allegro Musique — 2025 — 161,413 claimed users — alleged database. The music-education service is named, but no confirmed field inventory exists. Student, parent, teacher, schedule, address, contact, or payment data remains unknown.
80. Prime Énergie ENGIE — 2023 — 157,466 claimed users — alleged database. The index claims a file associated with an energy-subsidy portal but provides no verification. Applicant identity, property, energy, tax, eligibility, contact, and payment details should not be attributed without an official notice.
81. Cistes — 2019 — 156,507 claimed users — alleged database. The source lists a geocaching forum and says a re-upload was needed, but does not confirm fields. Usernames, emails, locations, private messages, IP addresses, or password hashes remain unverified.
82. SFR — October 2024 — 150,781 claimed users — alleged forum dataset. This is the third 2024 SFR entry in the index, making duplication highly likely. Readers should rely on SFR's individual notice for exact fields rather than treating each forum count as a separate breach.
83. Clyo Systems — 2023 — 147,820 claimed users — alleged database. The financial-software developer is named, but the population and data fields are not. Business-customer, employee, merchant, financial, login, and support records are all unconfirmed.
84. Sorbonne Université — 2024 — 146,987 claimed users — alleged database. The index supplies no operator disclosure or field list. Student, applicant, alumni, staff, email, academic, and identity records must not be inferred from the count.
85. UCAR — 2021 — 138,959 claimed users — alleged database. The vehicle-rental company is named without independently verified data classes. Customer identity, driving license, rental, vehicle, address, phone, payment, or insurance details remain unconfirmed.
86. Wobz Print — 2026 — 134,212 claimed records — alleged database. The supplied forum listing is the only evidence presented for this specific claim, and no public field list was located. Customer, order, product-design, delivery, or business-contact information should not be asserted.
87. Lions France — 2025 — 125,878 claimed users — alleged database. The nonprofit network is named, but no fields are verified. Member, donor, event, club, contact, or payment information remains unknown.
88. Cdiscount — 2020 — 122,848 claimed users — alleged database. The index does not supply a breach notice or fields for this specific dataset. Customer identity, addresses, purchases, account credentials, and payment information must not be inferred.
89. Turf.fr — 2021 — 121,053 claimed users — alleged database. The horse-racing service is named without a reliable field inventory. Account, betting interest, subscription, identity, contact, or payment data remain unconfirmed.
90. Syma Mobile — 2025 — 117,962 claimed users — alleged database. No operator notice or verified fields accompany the listing. Treat subscriber, phone, SIM, identity, contact, account, and payment information as unknown.
91. Cyphoma — 2020 — 116,840 claimed users — alleged database. The overseas classifieds marketplace is named but the source provides no fields. Seller/buyer names, contact details, listings, messages, locations, IP addresses, or passwords are unconfirmed.
92. Fédération Française des Échecs — 2025 — 113,953 claimed users — alleged database. The index attributes a database to the chess federation but gives no reliable fields. Licensee, club, ranking, date-of-birth, contact, and login information remain unverified.
93. Miotte private hospital and a Sallanches ophthalmologist — 2025 — 103,515 claimed users — alleged combined medical database. The source combines two healthcare entities and does not supply a validated field list. It would be unsafe to claim diagnosis, treatment, appointment, prescription, or patient identity fields without official confirmation.
94. BLACKSTORE — 2025 — 101,979 claimed users — alleged database. The fashion retailer is named without a public field inventory. Names, emails, addresses, phone numbers, loyalty records, purchases, and payment details remain unconfirmed.
95. Ioburo — 2025 — 93,746 claimed users — alleged database. The office-retail company is named but no fields are provided. Consumer or business contacts, orders, delivery addresses, invoices, and account data should not be asserted.
96. HardFight — 2016 — 91,728 claimed users — alleged database. The source lists a Minecraft server and gives no field list. Usernames, emails, IP addresses, and password hashes are common in such breaches but remain unverified here.
97. ENI French customers — 2025 — 89,459 claimed users — alleged database. The index claims a France-specific customer file for the energy company but supplies no corroborated fields. Identity, address, meter, contract, consumption, phone, email, and bank details are all unknown.
98. Nicovip — 2025 — 85,897 claimed users — alleged database. The e-cigarette retailer is named, but the inventory field is missing. Age, identity, contact, order, address, account, and payment data remain unconfirmed.
99. Legilog — 2026 — 81,599 claimed users — alleged database, with a separately reported ransomware listing.Public threat intelligence recorded a ransomware claim involving Legilog in April 2026, but that alone does not validate the forum row count or fields. Customer, employee, software, billing, and support data should remain unspecified unless Legilog confirms them.
100. Direct Assurance / AXA "ROMUX" — 2025 — 80,586 claimed email addresses — unattributed or disputed database. The source itself says it is unsure whether the data belongs to Direct Assurance or another system. Email addresses are implied, but attribution and all additional fields are unverified.
101. Boesner — 2019 — 78,570 claimed users — alleged database. The art-supplies retailer is named without independently confirmed fields. Customer identity, email, phone, address, purchase, or password information remains unknown.
102. Norauto Location — 2024 — 78,248 claimed users — scrape. The item is labeled a scrape of the vehicle-rental service. No source confirms whether it contains public branch/fleet data, customer records, rentals, driving-license information, or contact details.
103. Fédération Française d'ULM — date unknown — 78,133 claimed users — scrape. The source does not distinguish public club, pilot, aircraft, event, or result information from protected licensee records. No breach or private-field list is established.
104. InstruRap — 2021 — 75,292 claimed users — alleged database. The music platform is named but no fields are verified. Creator usernames, emails, purchases, uploads, messages, IP addresses, or password hashes remain unknown.
105. PayTrip — 2025 — 74,806 claimed users — alleged fintech database. The index is uncertain about whether the data was breached or merely posted, and it supplies no field inventory. Identity, account, card, transaction, beneficiary, contact, and compliance data should not be inferred.
106. Lifebox — 2022 — 74,675 claimed users — alleged database. The security company is named, but no reliable public field list is available. Customer identity, address, alarm or device information, service history, and account credentials remain unconfirmed.
107. Université Paris 1 Panthéon-Sorbonne — 2024 — 73,347 claimed users — alleged database. The source calls this unofficial and offers no operator confirmation or fields. Student, applicant, staff, academic, identity, contact, and login information should not be asserted.
108. Fédération Française de Canoë-Kayak — date unknown — 72,178 claimed users — scrape. The item is labeled a scrape rather than a breach. Public results, clubs, events, and licensee references may be involved, but no private data classes are confirmed.
109. Trescal — 2025 — 70,981 claimed users — alleged database. The metrology company is named, but no independently verified field inventory exists. Business contacts, employees, customers, equipment, service certificates, invoices, or logins remain unknown.
110. La Pizza de Nico — 2025 — 69,382 claimed users — alleged database. No trustworthy field list accompanies the restaurant database claim. Loyalty, order, store, email, phone, address, and payment data remain unconfirmed.
111. Groupe Zéphir — 2025 — 67,294 claimed users — alleged insurance database. The index gives no corroborated fields. Policyholder identity, quotes, contracts, claims, contact, health, vehicle, property, and bank details must not be inferred.
112. Service National Universel — 2023 — 59,563 claimed users — alleged database. The youth civic program is named, making the claim potentially sensitive, but the source provides no reliable fields. Minor status, identity, contact, parent, school, placement, health, or travel information remains unverified.
113. Infomax Paris — 2023 — 57,932 claimed users — alleged database. The PC retailer/assembler is named, but no field list is provided. Customer identity, address, phone, email, device specifications, repairs, purchases, and account data remain unknown.
114. Roller'n Co — 2025 — 59,509 claimed users — alleged database. The source lists a board-sports retailer and no validated fields. Customer contacts, addresses, orders, loyalty accounts, or payments should not be stated as exposed.
115. Fédération Française Sportive de Twirling Bâton — date unknown — 52,785 claimed users — scrape. This is labeled a scrape and may contain public clubs, events, results, or athlete references. The index does not establish private contact, birth-date, license, or login data.
116. La Bonne Alternance — 2024 — 47,808 claimed users — alleged database. The government apprenticeship platform is named, but no field list is verified. Applicant, employer, job, contact, profile, application, or account information remains unconfirmed.
117. Philharmonie de Paris — 2026 — 47,562 claimed users — alleged database. No public confirmation or field inventory for this exact listing was located. Ticket-buyer, member, donor, event, contact, address, or payment information should not be assumed.
118. Storepascher — 2023 — 43,420 claimed users — alleged database. The home-interiors retailer is named, but the fields are not corroborated. Customer identity, email, phone, address, product, order, invoice, or account data remains unknown.
119. France Solar — 2024 — 42,060 claimed users — alleged database. The solar installer is named but the index does not establish fields. Homeowner identity, property, energy, quote, installation, financing, tax, and contact data should not be inferred.
120. Corse GSM — 2024 — 41,955 claimed users — alleged database. This is one of two Corse GSM entries and may overlap with the later file. Subscriber, customer, SIM, device, repair, contact, purchase, and payment fields remain unconfirmed.
121. Bailti — 2025 — 38,933 claimed users — alleged database. The roommate platform is named, but no verified field list is provided. Identity, age, address, housing preferences, listings, messages, contact, or login data may be sensitive but cannot be stated as exposed facts.
122. Cergap — 2025 — 36,267 claimed users — alleged insurance database. The index provides no field inventory or operator notice. Policy, claims, identity, address, phone, email, vehicle, property, health, or bank data remains unknown.
123. Fédération Française de Tir, Pays de la Loire — 2025 — 35,634 claimed users — alleged database. The source does not confirm fields. Licensee identity, club, date of birth, address, contact, competition, or firearms-related information should not be attributed without official evidence.
124. Monogram Paris — 2023 — 35,650 claimed users — alleged database. The luxury resale platform is named, but no reliable fields are supplied. Customer identity, address, purchases, consignments, item ownership, authentication, contact, and payment data remain unconfirmed.
125. Dimasport — 2024 — 33,000 claimed users — alleged database. The sports-equipment supplier is named, but its field inventory is unverified. Customer, school, club, business-contact, order, delivery, and invoice records should not be assumed.
126. Kiute — 2021 — 32,934 claimed users — alleged database. The salon-booking service is named, but no fields are confirmed. Client identity, phone, email, appointment, salon, service, notes, account, and payment data remains unknown.
127. EDF — date unknown — 32,167 claimed users — alleged database. The energy provider is named, but no date, notice, or field list is provided. Customer identity, address, meter, contract, consumption, phone, email, bank, or login information should not be asserted.
128. École Nationale de Sécurité — 2025 — 29,103 claimed users — alleged database. The training center is named, but the source supplies no fields. Student identity, qualifications, course records, employer, address, contact, certificates, or payments remain unverified.
129. Bol d'Air — 2024 — 24,425 claimed users — alleged database. The adventure park is named, but the fields are not corroborated. Booking, participant, waiver, age, contact, address, purchase, or payment information remains unknown.
130. Corse GSM — 2025 — 23,924 claimed users — alleged database. This may be a separate incident, a partial copy, or overlap with the 2024 Corse GSM item. The source provides no field list to distinguish the two files.
131. Paris à Cœur Ouvert — 2026 — 616 claimed users — alleged political-website database. Although small, political affiliation or engagement can be sensitive personal data under the GDPR. The index supplies no verified fields, so names, emails, donations, messages, or supporter status should not be claimed without evidence.
How to find out whether your name or email was involved
Do not download leaked databases or pay a forum to search them. Raw breach files may contain malware; viewing or possessing them can expose other victims, and a criminal seller has every incentive to misrepresent what they have.
Use this safer process instead:
Start with the organization's notice. Search your inbox for the company or agency name plus terms such as "incident de sécurité," "violation de données," or "cyberattaque." Under the GDPR, an organization must inform affected people without undue delay when a breach is likely to create a high risk.
Check your own email through a reputable breach-notification service. HIBP lets you verify whether an email address appears in many known breaches. No results do not prove no breach occurred, because many incidents are never loaded into public services.
Exercise your GDPR right of access. Ask the organization whether it processes your data, what categories it holds, the source, the recipients, the retention period, and whether the incident affected your record. Keep a dated copy of the request and response.
Request erasure where the law allows it. Article 17 of the GDPR can apply when data is no longer necessary, consent has been withdrawn, processing is unlawful, or another legal ground exists. Deletion is not absolute: organizations may have to retain invoices, public-interest records, or evidence needed for legal claims.
Secure the accounts around the exposed identity. Change any reused passwords, turn on multifactor authentication, replace guessable security-question answers, and verify account-recovery phone numbers and email addresses.
Treat personalized messages as suspicious. A scammer quoting your name, address, provider, recent purchase, IBAN, or France Travail status has not proved legitimacy. Contact the organization through a number or website you already trust.
Watch financial accounts. If an IBAN or bank data was exposed, review direct debits and account activity, enable alerts, and ask your bank what protections are appropriate. An IBAN is not a password, but it can support fraudulent direct-debit attempts and convincing impersonation.
Document fraud and report it. Preserve emails, SMS messages, headers, screenshots, transaction records, and dates. Cybermalveillance.gouv.fr provides a diagnostic and current guidance; report unauthorized payments to your bank and file a police complaint when appropriate.
How deleteme can help after a data leak
deleteme cannot reverse a breach, delete a criminal's offline copy, change an exposed social security number, or guarantee removal from every unlawful forum. No legitimate privacy service can make those promises.
What deleteme can do is reduce the amount of easily searchable personal information that can be combined with leaked data:
Search for exposure tied to your identity. deleteme's process uses the names and aliases, email addresses, phone numbers, and current or former addresses you provide to find matching records across supported data brokers, people-search services, and, for applicable plans, open-web sources.
Show what was found. A deleteme Privacy Report can identify sites containing your information, the exposed data points, and the status of removal work. That creates a practical inventory instead of forcing you to repeat dozens of manual searches.
Submit and track opt-outs. deleteme sends removal or suppression requests to supported third parties, verifies results, and monitors for reappearance. That matters because broker listings can return when new public records or marketing feeds are ingested.
Support France. deleteme lists France among the countries supported by its international consumer service. Business international plans also include France, with country-specific broker searches and monitoring; exact coverage depends on the plan.
Help reduce breach amplification. Removing a broker profile cannot un-leak an old file, but it can make it harder to enrich a leaked email address or phone number with a current home address, relatives, property information, or other identity clues.
Request France-only data-broker removal assistance
We suggest a FREE Privacy Scan, which includes a Dark Web Email Scan, Data Broker Scan, and Internet Exposure Scan. You can do multiple searches.
Getting started takes just a few seconds—no credit card is required. Once your scan is complete, you'll receive two complimentary reports:
Data Broker & Internet Exposure Report
Data Breach & Dark Web Report
People who want a data-broker removal service focused only on France can contact deleteme on request. Send an inquiry to support @ deleteme.com describing the personal information you want investigated or removed and the French sites or brokers involved. Service availability, eligible sources, identity-verification requirements, response times, and removal outcomes depend on the individual request; sending an email does not guarantee that every listing or leaked copy can be removed.
The distinction matters: breach investigation tells you what may already have escaped; data-broker removal reduces the additional information strangers can readily attach to it. People at higher risk—executives, public-facing staff, abuse survivors, journalists, or anyone repeatedly targeted by impersonation—may also need direct help from their bank, employer security team, attorney, insurer, law enforcement, or a specialist incident-response provider.
What deleteme does not replace
deleteme is not a credit bureau, bank-fraud monitor, antivirus product, password manager, police service, CNIL complaint channel, or forensic dark-web investigation service. It should be one layer in a broader response that includes account security, financial monitoring, official notifications, and GDPR requests.
It is also important to set expectations around removal. A data broker may refuse, delay, or legally retain some data; public-interest and statutory-retention exceptions can apply; and information may reappear from new sources. deleteme's own terms describe the service as making good-faith, reasonable efforts rather than guaranteeing that every third party will comply.
Frequently asked questions
Did these websites "steal" people's data?
Usually no. In a breach, an attacker steals or accesses data held by an organization. The affected company may still face scrutiny for inadequate security, excessive retention, or delayed notification, but calling every listed site a thief would be inaccurate and potentially defamatory.
Are all 131 entries confirmed data breaches?
No. The source includes confirmed incidents, alleged databases, scrapes, open-data registers, collections, and likely duplicates. Most forum-only entries do not publish enough evidence to identify the fields or even prove the named organization was the source.
Does 279,746,410 records mean nearly 280 million French people were affected?
No. France's population is far smaller, and record totals can include multiple rows per person, repeat incidents, duplicate emails, business records, deceased-person records, public profiles, and collections of older data.
Can I ask a French organization whether I was affected?
Yes. A GDPR access request can ask whether the organization processes your personal data and request information about categories, sources, recipients, retention, and the incident. Affected organizations also have notification duties when a breach is likely to create a high risk, or you can try our FREE Privacy Scan, which includes a Dark Web Email Scan and Internet Exposure Scan; you can do multiple searches.
Getting started takes just a few seconds—no credit card is required. Once your scan is complete, you'll receive two complimentary reports:
Internet Exposure Report
Data Breach & Dark Web Report
Can deleteme remove my information from a hacked database?
deleteme may be able to remove or suppress matching listings from supported brokers and open-web sources, but it cannot guarantee deletion from criminal archives, private copies, or every breached system. Its most useful role is reducing the legitimate and searchable data that can be used to enrich leaked records.
Sources
Regulators and French public authorities
CNIL, France Travail: investigation, exposed fields, and advice, March 13, 2024.
CNIL, France Travail fined €5 million, January 29, 2026.
CNIL, Free and Free Mobile fined €42 million, January 14, 2026.
Légifrance/CNIL, Decision SAN-2026-002 concerning Free, January 8, 2026.
CNIL, Lessons from massive data breaches in 2024, January 28, 2025.
CNIL, Dedalus health-data leak summary in the 2022 annual report.
CNIL, Data-leak and theft guidance, March 18, 2024.
CNIL, Right to erasure.
CNIL, Rights to access, rectify, erase, object, and restrict.
Cybermalveillance.gouv.fr, What to do after a personal-data leak, updated August 26, 2026.
La Poste Mobile, Information about the July 4, 2022 cyberattack.
French Ministry of the Interior, April 2026 update on the ANTS security incident.
CNIL, Viamedis and Almerys breach investigation and exposed fields, February 7, 2024.
French Ministry of the Interior, April 21, 2026 update on the ANTS/France Titres incident.
French Ministry of Finance, DGFiP unauthorized-access FAQ and exposed fields, August 21, 2026.
French Ministry of National Education, July 2026 security-incident update, August 18, 2026.
Breach verification and incident disclosures
Have I Been Pwned, complete breach corpus/API and breached-sites directory. HIBP data is used with clear attribution; counts generally represent unique email addresses rather than total rows.
HIBP, Boulanger, LDLC, Sport 2000, Shadow, Le Slip Français, and Zadig & Voltaire.
Groupe LDLC, cybersecurity incident disclosure.
Fédération Française de Rugby, network cyberattack disclosure.
Short Édition, cyberattack disclosure.
Le Monde, Boulanger, Cultura, and other French retailers affected, September 11, 2024.
deleteme service and scope
deleteme, international consumer availability, including France.
deleteme, how deleteme works.
deleteme, understanding the Privacy Report.
deleteme, international business plans and France coverage.
deleteme, terms of service and removal limitations.
Unofficial dark web forums lead sources
The original dataset index and some later claims were circulated through dark-web or criminal-forum communities, including BreachForums and darkforums, as well as reposting and breach-sharing groups using changing names and accounts. These forums are identified only to explain where allegations originated: they are not authoritative sources, their claims may be false, duplicated, mislabeled, manipulated, or incomplete, and this article does not link to their pages or leaked downloads.
Methodology and limitations
This article uses the user-supplied 131-entry index as a lead list, not as proof. Dates and record counts are reproduced as claims when no stronger source exists. Confirmed fields are drawn from the CNIL, affected organizations, HIBP, and reputable reporting. No leaked file was downloaded, opened, searched, or redistributed.
The list is not a complete history of every French breach, and several major French incidents fall outside it. Conversely, being named in the index does not prove that an organization was hacked. Readers and editors should preserve the qualifiers—claimed, alleged, scrape, collection, confirmed, and unknown—during publication.
Disclaimer: This article is provided for general privacy and cybersecurity information, not legal, financial, or forensic advice. Inclusion of an organization does not, by itself, prove it was breached, and deleteme cannot guarantee discovery or removal of every exposed record, criminal copy, search result, or data-broker listing.
Need help? Visit our Help Center.
More Privacy Tips
