End of the world, end of the month, same fight. The old slogan of the yellow vests was on the program of the mobilization this Saturday, October 17. Cybercriminal forums saw their own convergence of struggles that day, with around twenty French organizations whose files were claimed within hours.
For a crypto holder, each leaked postal address becomes a very concrete risk. France has already experienced a series of crypto-kidnappings fueled by this type of file, and the weekend's harvest is copious.
Key Points
More than 9 million people potentially affected according to FrenchBreaches count
Medical data, identity documents and delivery addresses in the batch
The CAF website falls on Saturday morning, a pro-Russian group targets ANSSI
Passwords, double authentication and wary of email traps are a priority
Cyberattacks of October 17: the results of FrenchBreaches
The count comes from Seb La Tombe, founder of FrenchBreaches, the platform which documents data leaks in France on a day-to-day basis. In his summary published this Sunday morning, he puts the number of people potentially affected at more than 9 million. Six names make up most of the volume.
Nomad Education, 4.8 million user files including pupils and students
I-CAD, 2.2 million animal owners and 50,000 veterinarians
Centrale Canine, 1.4 million dog owners
French Shooting Federation, 586,854 licensees, 64,000 identity photos and 19,000 documents
O’Tacos, 334,474 delivery addresses
Inter-Etab, 286,773 student files
The list continues with the 49,761 billing records from Alain Afflelou and the 16,556 documents from Malakoff Humanis, which include hospital care and reimbursement histories. More than 38,000 customers of the Gilles and Laudier armories are also out in the wild. Masonic denominations were not spared, with 3,400 internal documents from the Traditional Grand Lodge of France and 987 people linked to the Women's Grand Lodge exposed.
Be careful with the addition. These figures are hacker claims, most of which FrenchBreaches classifies as credible but not yet confirmed. A pseudonym often comes up, ChimeraZ, behind the Centrale Canine, Malakoff Humanis and the Grande Loge Féminine. We were unable to verify the claim against I-CAD, whose manager had so far only acknowledged a leak of around 2,000 email addresses identified in 2025.
CAF and ANSSI in the sights of denial of service cyberattacks
Saturday morning, caf.fr and the CAF mobile application displayed “This site is inaccessible” for several hours. A distributed denial of service (DDoS) attack is suspected, this technique which saturates a site with requests until it becomes unavailable. No official confirmation has come. A technical failure remains possible.
The CyberTroll Team group, for its part, claims an attack launched around 10 a.m. against the site of ANSSI, the agency responsible for state cybersecurity. Appearing at the beginning of October, he affiliated with NoName057(16). This pro-Russian collective pays its volunteers in crypto, around $1.20 per day in dCoins convertible into TON. According to Seb La Tombe, the sites of the cities of Marseille and Lyon, that of Toulouse Métropole and that of L’Humanité were also targeted.
The noise on Telegram often exceeds the actual damage. In its 2026 threat report, the European agency ENISA indicates that only 23.8% of NoName057(16) claims examined were corroborated by independent availability checks.
Victim of a data leak? The reflexes recommended by FrenchBreaches
The “What to do?” page » by FrenchBreaches details the actions of the first 24 hours. Change the password for the relevant service and all accounts that share the same password. Enable two-factor authentication by app rather than by SMS. SMS remains exposed to SIM swapping, which consists of diverting your telephone line from the operator. Also disconnect open sessions and monitor your bank statements.
The next risk is called targeted phishing. A file that contains your name, address and health reimbursements allows you to write a very credible fake email. Do not click on any links received on behalf of the hacked organization and always go through its official website. If an identity document has been leaked, the platform recommends a pre-complaint online and refers to Cybermalveillance.gouv.fr and the CNIL.
On the crypto side, remember just one rule. No exchange or wallet manufacturer will ever ask you for your recovery phrase, those 12 or 24 words that give access to your funds. If you have been affected by an incident that is not yet listed, FrenchBreaches offers a “Report a leak” form and a contact page.
