Data breach affects 230,000 CTS customers

The Compagnie des transports strasbourgeois (CTS) has confirmed a data breach affecting about 230,000 customer accounts, nearly 40 percent of its customer base. The breach, which occurred in mid-October, was officially announced on October 28.

Personal information was compromised

The breach involved the retrieval of personal data such as names, dates of birth, postal addresses, and the Badgéo identifier linked to customer accounts. However, the company confirmed that passwords and banking details were not compromised.

Attack occurred during a weekend night

According to CTS general manager Emmanuel Auneau, the attack took place during the night of Sunday, October 18, to Monday, October 19. The breach was detected due to an unusually high number of database queries, which indicated suspicious activity.

Hackers exploited an API, not the system

Auneau explained that hackers did not infiltrate the company's internal computer systems but instead exploited an API to access data. The vulnerability has since been fixed, and the company has taken steps to prevent further data exfiltration.

CTS is reporting the breach to authorities

The CTS has informed the National Commission on Informatics and Liberty (CNIL) and will file a complaint with the Strasbourg court. Affected individuals have been notified by email, and the company is urging them to be cautious of potential phishing attempts.

Customers warned of fraudulent messages

The CTS has warned that stolen information could be used to create fake emails related to Badgéo subscriptions, account regularizations, or refunds. Auneau expressed regret for the inconvenience and urged customers to avoid clicking on links in suspicious messages and to verify information directly with the company.

Previous security incident reported

This is not the first time the CTS has faced a security issue, as two years ago some customer accounts were subject to unauthorized access. However, the current breach affects a much larger number of accounts, approximately 230,000.