The French data protection authority, CNIL, has issued warnings to citizens about the dangers of using so-called "pirate search engines" that compile data from recent major cyberattacks and allow users to search for their personal information online. These services, often run by cybercriminals or individuals who have purchased stolen data, pose serious risks. If users input their personal details, it can confirm the validity of their information to malicious actors, increasing the risk of identity theft or fraud. The CNIL has taken legal action against these platforms and advises people to avoid them, as there is currently no official secure alternative available. These search engines, sometimes called "lookups," gather data stolen in large-scale cyberattacks and let users search for information linked to their names, addresses, emails, or phone numbers. However, the CNIL warns that these services can be exploited by those behind the data breaches to build more comprehensive databases, sell access to the information, or even demand money for deleting it. The authority has noted a rise in complaints about these platforms and has prioritized cases involving them, working with the cybercrime prosecutor's office J3 in Paris and the ministry responsible for Digital Affairs. Attempts to remove these sites from hosting services have largely failed, as cybercriminals quickly move their operations to new domains. On social media, public frustration has grown over the spread of these tools, with many citizens calling for a public anti-fraud alert system that would notify individuals if their data is circulating without contributing to the databases of these pirate search engines. The CNIL recognizes the need for users to be informed about potential data exposure and is looking into solutions similar to the Dutch model, which offers certified and confidential checks for data exposure. Until an official service is available, the CNIL formally advises people not to enter their contact details on these directories. As of the first quarter of 2026, more than 2700 major cyberattacks and data thefts had already been recorded, with 6167 such incidents reported in 2025.