French Citizens data breach: what happened and what to do
In September 2024 a database holding over 90 million rows of data on French residents was left publicly exposed. Have I Been Pwned counts 28,445,106 accounts: emails, names, addresses, phone numbers, IP addresses, device details and partial card data.
View all 13,115 breaches- Breach date
- 25 Sept 2024
- Affected
- 28,445,106
- Data exposed
- Device information, Email addresses, IP addresses, Names, Partial credit card data, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
The "French Citizens" breach is different from most. It isn't one company's customer list. It is a collection assembled from many earlier leaks and then left on a server where anyone could reach it. Have I Been Pwned (HIBP) dates it to 25 September 2024, added it on 20 December 2024 and counts 28,445,106 unique accounts.
What happened
According to HIBP, over 90 million rows of data about French citizens were found in a publicly facing database. The rows came from various earlier data breaches, merged into one corpus. Cybernews researchers reported finding the exposed server, and other outlets gave slightly different row counts. HIBP's own figure is 90 million rows covering 28 million unique email addresses.
Nobody has published an owner for the database. Because it was a mashup, the same person can appear several times with different details from different source leaks.
What was exposed
HIBP lists device information, email addresses, IP addresses, names, partial credit card data, phone numbers and physical addresses. The fields vary from record to record, because each source breach held different things. Where card data appears, HIBP says it covers the payment type and the last 4 digits only, not full numbers.
HIBP doesn't list passwords for this one.
What that lets criminals do
A merged dataset is useful to scammers because it links details that used to sit in separate places. An email address from one breach gets a phone number from another and a street address from a third. The result is a profile detailed enough to make a fraud call or text sound real.
Phishing that imitates a French company the victim actually uses is the most likely misuse. A message that cites the right name, address and last 4 digits of a card is much harder to dismiss than a generic one. Smishing (phishing by text) works the same way using the phone numbers.
Partial card data can't be used to pay on its own. It is used as proof: a caller says "we see a card ending in 1234" to look like your bank. If someone says that on an unexpected call, hang up and phone your bank on the number printed on your card.
IP addresses and device information are less dangerous directly, but they reveal roughly where you are and what you use.
The company's response
There's no company response, since no single company owned the data. Hosting providers can pull a server like this offline, and reports say the host responded quickly once contacted. The sources below describe how the exposure was found.
Check your exposure
Search your email address on HIBP. A match means the address was in the compiled set, and it is worth checking what other breaches list you as well, because this dataset was built from them.
What to do if you were in it
- 1
Expect phishing that uses your details
Emails, texts and calls that mention your name, employer or phone number are more believable. Don't click links in unexpected messages. Go to the company's site yourself, and treat urgent requests for money or codes as a red flag.
- 2
Verify card and bank messages through your bank
If someone cites the last 4 digits of your card, don't take that as proof they're your bank. Hang up and call the number printed on the card, or open your banking app yourself.
- 3
Check your statements
Look through card and bank statements for charges you don't recognise. Report anything odd to your bank straight away and ask about replacing the card if you're worried.
- 4
Change reused passwords from the older breaches
The data came from earlier leaks. If you reuse one password across sites, change it on the important ones and turn on two-factor authentication.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It checks breach databases for your email address and phone number and shows which breaches include you, so you know which passwords and accounts to deal with first.
Frequently asked
Was I affected by the French Citizens breach?
Search your email address on Have I Been Pwned. It lists 28,445,106 accounts in this dataset.
What was exposed?
HIBP lists device information, email addresses, IP addresses, names, partial credit card data, phone numbers and physical addresses. Which fields appear depends on the record.
Were full card numbers exposed?
No. HIBP says the card data was partial: the payment type and the last 4 digits.
Do I need to live in France to be in it?
The data was described as covering French citizens, so most records are about people in France. Anyone who used a French service could be included.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
