Hacker claims to sell French license plate data

On October 24, 2026, a hacker known as ChimeraZ announced the sale of a file containing nearly 850,000 French license plates, along with personal details like names, email addresses, phone numbers, and sometimes postal addresses. The file is said to have been obtained by exploiting a vulnerability on an unnamed website.

Data spans over a decade

According to FrenchBreaches, an analysis of a 175 MB copy of the file showed that the records cover a period from 2017 to 2026. This suggests the data may have been collected over nearly a decade, potentially exposing a large number of individuals to risks of identity theft or fraud.

Source not linked to major French systems

The file does not appear to originate from major French vehicle registration systems like the SIV or ANTS. Instead, it is believed to have come from an online service related to automobiles. ChimeraZ also claims to have a second database with nearly two million more license plates, but this has not been confirmed.

Risks of scams and impersonation

The information in the file could be used to create fake traffic violation notices sent via SMS or email, impersonating official entities like ANTAI. Victims might be tricked into paying fictitious fines through links. Scammers could also pose as insurers or garages to extract more sensitive information, such as bank details.

Legal consequences of license plate impersonation

Under Article L.317-4-1 of the Road Code, using a license plate impersonation to defraud others can result in penalties of up to 7 years in prison and 30,000 euros in fines. This highlights the seriousness of the offense and the potential legal consequences for those involved in such scams.

How to verify traffic violation notices

Motorists are advised to verify traffic violation notices directly on official government websites like antai.gouv.fr or amendes.gouv.fr by typing the address into their browser. They should avoid clicking on links in SMS or instant messages. If an SMS is suspicious, it can be reported to 33700.

Resources for data breach victims

The French government provides resources for victims of data leaks and scams on the platform cybermalveillance.gouv.fr. However, there is currently no public service that allows individuals to check if their license plate is included in the file sold by ChimeraZ. If someone receives a fine for an offense they did not commit, they may need to file a complaint and contest the notice within 45 days.