A suspected data breach at Auto-Planning, a French inspection scheduling firm, may have exposed 200 million data lines, including personal and vehicle details, raising concerns about data security.
Data breach reported in France
A suspected data breach involving Auto-Planning, a French company that manages technical inspection appointments for over 450 centers, has been reported by FrenchBreaches, a website that tracks data breaches in France. The breach allegedly involves access to over 200 million data records, including nearly 92 million appointments booked since 2008.Details of the exposed data
Each data record may contain a person’s name, mobile number, license plate, and the inspection center used. FrenchBreaches received detailed statistics, lists of establishments, and samples of personal data. However, the site remains cautious, stating that these samples show the type of information exposed but do not confirm that all data was copied.No official response from Auto-Planning
Auto-Planning has not issued any official statement regarding the breach. This incident follows a series of recent data breaches in France, including the sale of 1.2 million CAF beneficiary files and the hacking of Solutions30, a subcontractor for Orange and Bouygues Telecom. This pattern highlights the risk of hacking a single service provider, which can expose data for multiple companies that rely on them.Scope of the data exposure
The exposed data is estimated to contain approximately 18 million unique identities and 13.9 million license plates after removing duplicates. These figures align with the frequency of technical inspections, as a car owner typically returns every two years, resulting in five times more appointments than individuals. A file shared with FrenchBreaches lists 791 centers and 37.2 million active appointments, with some centers having the highest number of bookings.Nature of the exposed information
The samples examined by FrenchBreaches include personal details such as names, email addresses, mobile numbers, car make and model, license plates, appointment dates and times, and IP addresses used to book appointments. Hackers also claim to have 36,545 PDF invoices, which may contain RIBs (bank account details), source codes, and access to certain services. Of 572 password hashes examined, 161 were found in clear text, and the site notes the use of MD5, an outdated password protection algorithm.Hackers demand payment and offer assistance
The Auto-Planning site and that of Auto Contrôle Paris, both edited by the same company, reportedly displayed a defacement message from the hackers. Signed "Operation GlassLodge," the message demands 33,333 dollars within 72 hours or threatens to publish the data. The hackers also claim to offer help fixing the vulnerabilities they exploited. No direct link has been established between this attack and the PHP flaw that triggered widespread hacking attempts detected by Cloudflare.Legal obligations and lack of response
Under the GDPR, Auto-Planning is required to inform the CNIL (French data protection authority) within 72 hours of discovering a breach that poses a risk to individuals. However, at the time of writing, Auto-Planning has not confirmed the attack or warned drivers. It is not yet known which centers are affected.Warning to users about fraud
FrenchBreaches also warns users to be cautious of SMSs requesting payment of fines, registration fees, or confirmation of technical inspections, as these could be fraudulent. The ANTAI, the agency managing fines, states that it never sends SMSs, and real fines should be paid on amendes.gouv.fr. Suspicious SMSs can be reported to 33700. Users are advised to change passwords on any site where they reused passwords from a technical inspection booking platform. Cross-referencing car models with postal addresses could also allow thieves to identify specific vehicles.
