Customer data for sale online

Names and mobile numbers of Autosur customers have been for sale since October 31 on a forum for cybercriminals. The seller, ChimeraZ, mentions nearly 800,000 records without explaining how he obtained them. This was reported by FrenchBreaches.

Details of the data leak

ChimeraZ offers an archive of 248 MB, divided into two files of approximately 611,000 and 186,000 lines. He attributes these 798,502 records to 615,233 people, because a customer can appear on multiple records. Autosur, created in 1990, has more than 900 technical inspection centers in France under the banner of the European Society for Automotive Inspection (SECTA).

Autosur's response and uncertainty

The company has not confirmed the hacking. At the time of writing this article, nothing indicates whether the database for sale comes from a new intrusion, another computer system, or data stolen from Autosur in 2025. Especially not since this leak was not claimed by the well-known ChimeraZ, whose low-level tasks have appeared this year.

Possible origins of the data

The team from Cyberattaque.org indicates two samples of 500 records, all related to the "ancier" computer environment. Autosur has a center in Ancier, near Gray, in Haute-Saône. The files could therefore come from the management software of this center, or from a tool common to several establishments in the network for tracking their customers.

Further analysis and uncertainty

However, nothing indicates that the hundreds of thousands of other lines in the archive concern Ancier. According to the information obtained by FrenchBreaches late in the evening of Halloween, the data would rather come from the professional training service of the network, SECTA Formations, and not from the technical inspection centers. The specialist site acknowledges that the exact origin of the files still needs to be confirmed.

Previous security incident

In March 2025, Autosur had reported to its customers "unauthorized access to certain data", including their addresses and their license plate numbers. A hacker at the time claimed to have 10.7 million records, while the company mentioned 4 million affected customers. The samples from ChimeraZ contain no license plate numbers, and the hacker does not specify when or how he extracted his records.

Scope of the data

ChimeraZ announces 392,175 different phone numbers and 144,689 email addresses. According to the analysis from Cyberattaque.org, the 1,000 records in the samples contain 827 phone numbers, but only 130 email addresses, and no banking data or passwords. Several identities appear multiple times, and some records are incomplete.

Potential for fraud

The hacker has also shown, in his extracts, customer file numbers and internal identifiers. These pieces of information seem meager, but a scammer does not need more. It is enough to have a name and a mobile number to make a fake call from your Autosur center credible.

Advice for customers

If your phone rings in the name of Autosur, hang up, then call your center at the number indicated on the network's website. Never enter your bank card number on a page opened from an SMS, even if the message mentions your name or the date of your last inspection.

Preventive measures

In the weeks following a leak, the CNIL and Cybermalveillance.gouv.fr also advise, in their leaflet for victims, to monitor your bank statements and to refuse any direct debit authorization that you have not signed.