A cyberattack has targeted the Pass Pass Mobilités website and mobile application, impacting 19,000 users in the Hauts-de-France region. The Mixed Mobility Syndicate of Hauts-de-France, which operates the service, confirmed the breach and has reported the incident to the CNIL, France's data protection authority, as well as local cybercrime police. The data stolen includes users’ names, first names, postal addresses, emails, birth dates, and records of ticket purchases. However, the Syndicate clarified that no financial information, such as bank details, was compromised. The breach was first announced on September 5 on a dark web forum, a part of the internet that is not indexed by standard search engines and often used for illicit activities. The affected users had purchased online transport tickets or Pass Pass cards between January 2021 and August 18, 2026. They were notified of the breach via email, and the online store was temporarily closed starting September 8 to enhance digital security measures. The service is expected to resume operations by Friday, September 11, though users will need to update their mobile application to access the platform. Pass Pass Mobilités is a digital platform that allows users to purchase transport tickets for several urban transport networks in Hauts-de-France, including Ilevia, Transvilles, Marinéo, and Artis. Since early July, the platform has also offered the purchase of TER subscriptions, which are regional train passes. The incident has raised concerns about the security of digital ticketing systems and the need for stronger data protection measures in public transportation services. The Syndicate has emphasized that it is taking the breach seriously and is working closely with authorities to investigate the attack and prevent future incidents. Users are advised to remain vigilant for any suspicious activity and to update their applications once the service reopens. While the breach did not involve financial data, the exposure of personal information could still pose risks, such as identity theft or targeted scams.