> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# bitbybit Studio Customer Records and AI Chat Logs Offered for Sale
- URL: https://darkwebinformer.com/bitbybit-studio-customer-records-and-ai-chat-logs-offered-for-sale/
- Published: 2026-08-23T20:36:52.000Z
- Updated: 2026-08-23T20:38:13.000Z
- Author: Dark Web Informer
- Tags: Data Breaches

Breach Report France Retail, supplier compromise Price by offer 

## Bureau Vallée Data Allegedly Taken From a Supplier That Exported Every Store Daily

A forum user posting as **misere** is selling what they describe as the customer database of **bureau-vallee.fr**, a French office supplies chain, listing **13,725,669 total records reducing to 4,819,927 unique**. The actor does not claim to have breached the retailer. They describe taking the data from **a third party that generated a daily customer export for each store and placed the files on an external server**, said to be hosted outside France without protection. They further claim to have exploited injection flaws to obtain command execution and establish **persistent access held for around a month and still working**. A 10,000 record sample is published, but **no field list is given**. The claim is **unverified**.

Severity HIGH 

[ ![WhiteIntel, dark web exposure monitoring](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) 

Unique records4,819,927

Total records13.73M

AccessClaimed ongoing

Actormisere

### ▣Post details

Targetbureau-vallee.fr

CountryFrance

SectorOffice supplies retail

ListingSelling, price by offer

Volume4.82M unique of 13.73M

Stated sourceThird party exporter

ObservedAug 21, 2026

Actormisere

### !What the post claims

- 13.73M total records
- 4.82M unique records
- Daily per store exports
- Customer data in each file
- Files placed on an FTP host
- Server outside France
- No protection on that host
- Injection flaws on endpoints
- Database command execution
- Persistent access established
- Access held about a month
- Access claimed still live
- 10,000 record sample
- No field list published

### ◱Screenshot

[ ![Forum listing selling an alleged Bureau Vallee customer database of 4.8 million unique records, August 2026](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/08/25798235623875698273598726359871.png) Screenshot 1 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/08/25798235623875698273598726359871.png) 

Forum post offering the Bureau Vallee customer database for sale, observed 21 August 2026.

### ☷Mapped techniques

Mapped from the actor's own account. Claimed, not confirmed.

- Initial access [T1199](https://attack.mitre.org/techniques/T1199/) Trusted relationship Stated Data was taken from a third party that handled exports for the retailer, not from the retailer itself.
- Initial access [T1190](https://attack.mitre.org/techniques/T1190/) Exploit public facing application Stated Actor claims injection flaws on internet reachable endpoints.
- Execution [T1059](https://attack.mitre.org/techniques/T1059/) Command and scripting interpreter Stated Injection was escalated to command execution against the database.
- Persistence [T1505](https://attack.mitre.org/techniques/T1505/) Server software component Inferred Access described as held for around a month and still working. Mechanism not specified.
- Collection [T1213](https://attack.mitre.org/techniques/T1213/) Data from information repositories Stated A full customer export was generated for every store, every day, and written to one host.
- Exfiltration [T1048](https://attack.mitre.org/techniques/T1048/) Exfiltration over alternative protocol Stated Files were retrieved from an unauthenticated FTP host outside France.

### ⚠Potential impact

No fields are disclosed, so the contents remain unestablished and **scale is the only firm number**. What distinguishes this listing is the described mechanism. If a supplier really was writing **a full customer export for every store, every day, to an unprotected external server**, then the exposure is continuous rather than a single event, and the data would have been retrievable by anyone who found the host at any point in that arrangement. The claim of **persistence still working at the time of posting** means, if accurate, that collection may not have stopped. The wider concern is the same one raised by this actor's other listing hours earlier: an intermediary handling data for **a franchise network is likely to serve other clients too**, so the retailer named here may be one of several affected by a single supplier failure.

### iStatus Unverified

This post supplies the **mechanism that the same actor's beauty retailer listing, published nineteen minutes later, only gestured at**, and the two should be read together. The technical account is specific and self consistent, which is a point in its favour, but it is also **entirely uncorroborated and describes the actor's own conduct**, so it may be embellished to raise the asking price. No intermediary is named anywhere in the post. A ten thousand record sample is publicly downloadable and would settle the field question, though Dark Web Informer has **not retrieved it and is not linking those mirrors**, nor the contact address. The claim is **unverified** and neither the retailer nor any supplier has publicly addressed it.

Want everything on this breach? **Paid subscribers** get the full unredacted claim details and more. After subscribing, check out the [threat feed](https://darkwebinformer.com/threat-feed/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=bureau-vallee-2026-08-21&utm%5Fcontent=threat-feed) and search there for this alert.

[View pricing →](https://darkwebinformer.com/pricing?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=bureau-vallee-2026-08-21&utm%5Fcontent=pricing-button) 

[Dark Web Informer](https://darkwebinformer.com/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=bureau-vallee-2026-08-21&utm%5Fcontent=footer) // Threat Intelligence