AMF Data Leaked With Plaintext Passwords for Town Hall Accounts
A forum actor posting as Alduin has published data attributed to amf.asso.fr, the site of the Association des Maires de France, which represents mayors and heads of intermunicipal bodies. The actor states they found a union based SQL injection and extracted three tables. The largest is a subscriber list of named officials with work email addresses, job titles and employing commune. The second is an account table holding bcrypt hashes and a super administrator flag. The third is smaller and more serious: login addresses for town halls stored alongside passwords in plaintext. The files are released free behind a reply requirement. The claim is unverified.
▣Post details
!What the post claims
- SQL injection found
- Union based technique named
- Three tables extracted
- 114,000 subscriber records
- Names and first names
- Work email addresses
- Job titles
- Employing commune or body
- Subscription start dates
- Subscription end dates
- Account table with bcrypt hashes
- Super administrator flags
- Account type and identifiers
- Synchronisation version values
- Second account table
- Plaintext passwords
- Town hall login addresses
- JSONL format
◱Screenshots
☷Mapped techniques
Mapped from the actor's own account. Claimed, not confirmed.
- Initial access T1190 Exploit public facing application Stated The actor names an injection flaw in a query parameter as the entry point and says the tables were selected once access was obtained.
- Collection T1213 Data from information repositories Stated Three tables were chosen and exported individually rather than the database being taken wholesale, which indicates query level access.
- Credential access T1552 Unsecured credentials Stated One table stores passwords without hashing, so the credentials are usable as they stand rather than requiring cracking.
- Exfiltration T1567 Exfiltration over web service Inferred Distribution runs through forum hosting behind a reply wall.
⚠Potential impact
The plaintext table is the urgent part, because those credentials are usable immediately and the logins are official town hall and council addresses. The passwords visible in the sample are the kind people actually choose, built from place names and years, which makes reuse across municipal email and other local systems very likely. Separately, the subscriber list maps named officials, their roles and their commune across the country, which is a ready made targeting list for approaches to local government, and the super administrator flag in the second table points at the accounts worth attacking first. Anyone with an account here should treat that password as burned everywhere it was used.
iStatus Unverified
The post is more specific than most about method and structure, naming the flaw class, listing three schemas with consistent field naming and giving a size for each file. The passwords in the sample are a point in its favour, since they follow the untidy patterns real users produce rather than anything a fabricator would generate. What is absent is any way to check the 114,000 figure, which appears only in the thread title. Dark Web Informer has not retrieved the files and is not linking them, and AMF has not publicly addressed the claim.
Dark Web Informer // Threat Intelligence
