Agence Vauban Client Accounts and Property Files Shared Free on a Forum
A forum user posting as sh444d0w has published what they describe as the database of Agence Vauban, a real estate agency working the Antibes and French Riviera market. The post lists 5,430 user accounts with names, logins, emails, phone numbers and addresses, alongside a full table list covering property records, valuations, financing and expenses, rental agreements, floor plans and photographs. The published sample shows passwords stored as bcrypt hashes rather than plaintext. The data is not for sale and the account posting it was created the same month with no history. The claim is unverified.
▣Post details
!What the post claims
- 5,430 user accounts
- Names and login handles
- Email addresses
- Bcrypt password hashes
- Phone and mobile numbers
- Street, postcode, city, country
- Roles and permissions
- Password reset records
- Remember me tokens
- Property records and prices
- Owner or agent per property
- Interior and exterior detail
- Surface areas
- Addresses and coordinates
- Financing and expenses
- Profitability figures
- Rental agreements
- Floor plans and photographs
◱Screenshots
☷Mapped techniques
The post describes no intrusion method. Both entries are inferred from the artefacts, not stated.
- Collection T1213 Data from information repositories Inferred A complete table list including permissions, tokens and reset records indicates a full schema export rather than a scrape of a public listings page.
- Exfiltration T1567 Exfiltration over web service Inferred Distribution runs through the forum and a messenger contact. The route out of the environment is not described.
⚠Potential impact
Five thousand accounts is small, and the credentials are the least of it, since bcrypt hashing means these are not directly usable and only weak passwords will fall to cracking. The risk sits in the property side of the schema. An agency database of this type ties an owner to an address, a valuation, a set of financials and, in this case, floor plans and photographs, which is an unusually complete picture of a specific building and who holds it. On the Riviera, where a meaningful share of the stock is second homes and rentals that stand empty for much of the year, that combination has an obvious physical application, and occupancy is inferable from the rental agreements. The commercial risk is transaction fraud. Property purchases involve large transfers between parties who mostly communicate by email, and an approach that quotes the correct property, the correct price and the correct agent is the hardest kind to detect. Anyone who has bought, sold or rented through this agency should treat payment instructions arriving by email as suspect until confirmed by phone.
iStatus Unverified
The sample is structurally convincing. Table and column naming, the presence of remember me tokens and password reset records, and bcrypt hashes at a standard cost factor are all consistent with a real application backend rather than something assembled by hand. That said, a set this small is also cheap to fabricate, hashes can be generated for any password, and structure alone proves a schema was copied rather than that this particular agency was compromised. The account is brand new, one post, one thread, no reputation, and the data is given away rather than sold, so there is no price to defend and no track record to weigh. No intrusion method, no date and no access route are described anywhere in the post. Dark Web Informer has not retrieved the data and is not linking it, nor the contact address. Agence Vauban has not publicly addressed the claim.
Dark Web Informer // Threat Intelligence
