On Saturday 17 October, cybercriminal forums saw the claimed files of some twenty French organisations scroll past within a few hours. According to the FrenchBreaches tally, more than 9 million people are potentially affected. The figure is mostly a sum of hackers’ claims. Here is what we know, what remains to be confirmed, and why this data leak also concerns crypto holders.

A wave of cyberattacks: the claimed toll

The tally comes from Seb La Tombe, founder of FrenchBreaches, a platform that documents data leaks in France day by day. In a recap published on Sunday morning, he puts the number of potentially affected people at more than 9 million. Six names account for most of the volume:

  • Nomad Education: 4.8 million user records, including pupils and students;
  • I-CAD: 2.2 million pet owners and 50,000 veterinarians;
  • Centrale Canine: 1.4 million dog owners;
  • French Shooting Federation (Fédération française de tir): 586,854 licence holders, 64,000 ID photos and 19,000 documents;
  • O’Tacos: 334,474 delivery addresses;
  • Inter-Etab: 286,773 pupil records.

The list goes on with 49,761 billing records from Alain Afflelou and 16,556 documents from Malakoff Humanis, including hospital coverage approvals and reimbursement histories. More than 38,000 customers of the Gilles and Laudier gun shops are also said to be in the batch, as are 3,400 internal documents of the Grande Loge Traditionnelle de France and 987 people linked to the Grande Loge Féminine.

Caution is warranted, however: these are hackers’ statements, most of which FrenchBreaches rates as credible, but they are not yet confirmed. The same pseudonym, ChimeraZ, appears behind several of them: Centrale Canine, Malakoff Humanis and the Grande Loge Féminine. Le Journal du Coin notes that it was unable to cross-check the claim targeting I-CAD, whose operator had so far acknowledged only a leak of around 2,000 email addresses identified in 2025.

The CAF and ANSSI targeted by denial-of-service attacks

On the same Saturday morning, the caf.fr website and the CAF mobile app displayed “This site can’t be reached” for several hours. A distributed denial-of-service (DDoS) attack is suspected. The principle: flood a site with requests until it becomes unavailable. No official confirmation has come, and a technical outage remains possible.

For its part, the group CyberTroll Team claims an attack launched around 10 a.m. against the website of ANSSI, the agency responsible for the French state’s cybersecurity. Having emerged in early October, it says it is affiliated with NoName057(16), a pro-Russian collective that pays its volunteers in crypto, around 1.20 dollars a day in dCoins convertible into TON. According to Seb La Tombe, the websites of the cities of Marseille and Lyon, that of Toulouse Métropole and that of L’Humanité were also reportedly targeted.

The noise often exceeds the real damage. In its 2026 threat landscape report, the European agency ENISA states that only 23.8% of the NoName057(16) claims examined were corroborated by independent availability checks.

A week earlier, the Cnaf had suspended Vacaf, its holiday-assistance platform, after a hack claimed to involve 1,191,967 beneficiary files. And on 30 September, ANSSI published the assessment of its own compromise via the Metabase software, with 120 accounts affected.

Why a leaked postal address exposes crypto holders

For a crypto holder, the most sensitive piece of data is not necessarily a password. A postal address linked to a name makes it possible to locate a person. France has already experienced a series of crypto-related kidnappings fuelled by this type of file: in April, the courts had already brought 88 indictments in this wave of crypto abductions.

The second risk is targeted phishing. A file combining a name, an address and health reimbursements makes it possible to write a highly credible fake email in the name of an organisation the victim knows. One rule holds in every case: no exchange and no wallet manufacturer will ever ask for the recovery phrase, those 12 or 24 words that give access to the funds.

Useful reflexes, in France as in Switzerland

These files concern French organisations, but the mechanism knows no borders. In Switzerland too, a data leak can occur through a service provider. The FrenchBreaches “What to do?” page details the steps for the first 24 hours:

  • change the password of the affected service and of all accounts that share the same one;
  • enable two-factor authentication via an app rather than by SMS, since SMS remains exposed to SIM swapping, the hijacking of the phone line through the operator;
  • log out of open sessions and monitor your bank statements;
  • do not click on any link received in the name of the hacked organisation and always go through its official website.

If an identity document has leaked, FrenchBreaches recommends filing an online pre-complaint in France and refers people to Cybermalveillance.gouv.fr and the CNIL. For everyone, protecting personal data also means being wary of any message that relies on information the sender should not know.

Sources

  • Journal du Coin: “Wave of cyberattacks in France on 17 October: 9 million people affected”