> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# AMF Data Leaked With Plaintext Passwords for Town Hall Accounts
- URL: https://darkwebinformer.com/amf-data-leaked-with-plaintext-passwords-for-town-hall-accounts/
- Published: 2026-09-04T17:56:32.000Z
- Updated: 2026-09-04T17:56:32.000Z
- Author: Dark Web Informer
- Tags: Leaks

Breach Report France Local Government Plaintext Passwords 

## AMF Data Leaked With Plaintext Passwords for Town Hall Accounts

A forum actor posting as **Alduin** has published data attributed to **amf.asso.fr**, the site of the **Association des Maires de France**, which represents mayors and heads of intermunicipal bodies. The actor states they found **a union based SQL injection** and extracted three tables. The largest is a subscriber list of **named officials with work email addresses, job titles and employing commune**. The second is an account table holding **bcrypt hashes and a super administrator flag**. The third is smaller and more serious: **login addresses for town halls stored alongside passwords in plaintext**. The files are released free behind a reply requirement. The claim is **unverified**.

Severity HIGH 

[ ![WhiteIntel, dark web exposure monitoring](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) 

Subscribers114,000

TablesThree

PasswordsPlaintext

ActorAlduin

### ▣Post details

Targetamf.asso.fr

CountryFrance

SectorLocal government body

ListingFree, reply to unlock

VolumeThree tables, 114K claimed

Stated sourceSQL injection

ObservedSep 4, 2026

ActorAlduin

### !What the post claims

- SQL injection found
- Union based technique named
- Three tables extracted
- 114,000 subscriber records
- Names and first names
- Work email addresses
- Job titles
- Employing commune or body
- Subscription start dates
- Subscription end dates
- Account table with bcrypt hashes
- Super administrator flags
- Account type and identifiers
- Synchronisation version values
- Second account table
- Plaintext passwords
- Town hall login addresses
- JSONL format

### ◱Screenshots

[ ![Forum post publishing data attributed to the French association of mayors, September 2026](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/4978357280936578962359876235987629873598.png) Screenshot 1 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/4978357280936578962359876235987629873598.png) [ ![Second section of the same post showing two account tables, shown redacted](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/4978357280936578962359876235987629873599.png) Screenshot 2 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/4978357280936578962359876235987629873599.png) 

Forum post publishing AMF data, observed 4 September 2026.

### ☷Mapped techniques

Mapped from the actor's own account. Claimed, not confirmed.

- Initial access [T1190](https://attack.mitre.org/techniques/T1190/) Exploit public facing application Stated The actor names an injection flaw in a query parameter as the entry point and says the tables were selected once access was obtained.
- Collection [T1213](https://attack.mitre.org/techniques/T1213/) Data from information repositories Stated Three tables were chosen and exported individually rather than the database being taken wholesale, which indicates query level access.
- Credential access [T1552](https://attack.mitre.org/techniques/T1552/) Unsecured credentials Stated One table stores passwords without hashing, so the credentials are usable as they stand rather than requiring cracking.
- Exfiltration [T1567](https://attack.mitre.org/techniques/T1567/) Exfiltration over web service Inferred Distribution runs through forum hosting behind a reply wall.

### ⚠Potential impact

The plaintext table is the urgent part, because those credentials are **usable immediately and the logins are official town hall and council addresses**. The passwords visible in the sample are the kind people actually choose, built from place names and years, which makes **reuse across municipal email and other local systems very likely**. Separately, the subscriber list maps **named officials, their roles and their commune across the country**, which is a ready made targeting list for approaches to local government, and the super administrator flag in the second table points at the accounts worth attacking first. Anyone with an account here should treat that password as burned everywhere it was used.

### iStatus Unverified

The post is **more specific than most about method and structure**, naming the flaw class, listing three schemas with consistent field naming and giving a size for each file. The passwords in the sample are a point in its favour, since they follow the untidy patterns real users produce rather than anything a fabricator would generate. What is absent is **any way to check the 114,000 figure**, which appears only in the thread title. Dark Web Informer has **not retrieved the files and is not linking them**, and AMF has not publicly addressed the claim.

Want everything on this breach? **Paid subscribers** get the full unredacted claim details and more. After subscribing, check out the [threat feed](https://darkwebinformer.com/threat-feed/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=amf-2026-09-04&utm%5Fcontent=threat-feed) and search there for this alert.

[View pricing →](https://darkwebinformer.com/pricing?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=amf-2026-09-04&utm%5Fcontent=pricing-button) 

[Dark Web Informer](https://darkwebinformer.com/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=amf-2026-09-04&utm%5Fcontent=footer) // Threat Intelligence