Data leak: the information of 230,000 French people compromised during a new cyberattack

The Strasbourg Transport Company (CTS) has just been the victim of a cyberattack. The data of around 230,000 customer accounts, or nearly 40% of its users, were hacked. The company calls on victims to be vigilant against phishing attempts.

A new data leak shakes France. The Strasbourg Transport Company (CTS), which manages the city's buses and trams, announces that it has been the victim of a cyberattack. In a press release, the company explains that it “recently identified an exfiltration of data concerning approximately 230,000 customer accounts, made possible by illicit use of its website”.

The stolen data includes name, first name, date of birth, postal address and customer ID. Good news, “banking data and passwords are not affected by this exfiltration”, specifies the CTS. There was no reason for this more sensitive data to be stored alongside other data.

The attack dates back to the night of Sunday October 18 to Monday October 19. Emmanuel Auneau, the director of the CTS, reveals to our colleagues at Latest News from Alsace that his teams have noticed “an abnormally high demand on our database”. The hackers used a flaw to achieve their ends, but the “servers are not altered”, and “the hackers have not infiltrated our computer system”. In fact, the crooks exploited a vulnerable application programming interface, which allows software to communicate with the CTS site.

The company claims to have reacted as soon as the cyberattack was detected. The press release indicates that “the exfiltration has been stopped and security around the site has been intensified”. The National Commission for Information Technology and Liberties (CNIL) has been notified, and a complaint will be filed with the Strasbourg court. This is not the first time that the CTS has found itself in the sights of cybercriminals. In 2024, the company had already recorded fraudulent access to certain customer accounts.

The 230,000 affected customers were notified by email this week. As the transport company explains, “the main risk associated with this exfiltration is that of phishing attempts, the data collected could be used to give greater credibility to fraudulent messages”. The CTS reminds that it never asks its customers to make a payment or to communicate bank details by email. If in doubt, do not click on any link and go directly through the site, or even better, through the official application on your smartphone.

The hacking of the CTS is added to the very long list of French entities victims of a data leak, which already includes taxes, several operators, and dozens of sports federations. According to a study by Cybermalveillance, France's cybersecurity platform, almost half of French people have been hacked this year.

Machine-translated from French