Data breach affects millions in France

A cyberattack has led to the theft of 14 million license plates and personal data belonging to 18 million individuals, according to a report by the website French Breaches on October 29. The breach involved two service providers, Auto-Planning and Auto-Controle-Paris, which manage technical inspection reservations for client partners.

Details of the stolen data

Auto-Planning confirmed the breach to BFM Tech, stating that the stolen data included invoices, confidential documents, source codes, RIBs (bank identification details), passwords, and amounted to 9 gigabytes of data. The data included the first and last names of motorists, their email addresses and mobile numbers, IP addresses associated with appointment reservations, the names and exact addresses of the inspection centers frequented, and 36,545 PDF invoices that may contain RIB information.

Potential risks from the breach

The stolen license plates alone do not pose a direct risk, but when combined with personal contact information, they can be used for phishing campaigns, fraudulent requests for fake technical inspections, and potential theft of banking information. Cybercriminals may also use the data to send fraudulent SMS or emails demanding payment for fines or administrative fees related to vehicle registration or supposed infractions, such as fake ANTAI fines.

Broader implications of the breach

The accumulated data could also lead to identity theft, where affected individuals might receive fines for acts they did not commit, as the license plates could be used by other vehicles. Additionally, the data could enable cross-referencing to determine the residences of affected individuals, increasing the risk of burglary.

French authorities informed

The CNIL, the French data protection authority, has been informed of the breach in accordance with their obligations. Affected individuals are advised to verify any suspicious communications directly with the relevant services or companies.