Bureau Vallée Data Allegedly Taken From a Supplier That Exported Every Store Daily
A forum user posting as misere is selling what they describe as the customer database of bureau-vallee.fr, a French office supplies chain, listing 13,725,669 total records reducing to 4,819,927 unique. The actor does not claim to have breached the retailer. They describe taking the data from a third party that generated a daily customer export for each store and placed the files on an external server, said to be hosted outside France without protection. They further claim to have exploited injection flaws to obtain command execution and establish persistent access held for around a month and still working. A 10,000 record sample is published, but no field list is given. The claim is unverified.
▣Post details
!What the post claims
- 13.73M total records
- 4.82M unique records
- Daily per store exports
- Customer data in each file
- Files placed on an FTP host
- Server outside France
- No protection on that host
- Injection flaws on endpoints
- Database command execution
- Persistent access established
- Access held about a month
- Access claimed still live
- 10,000 record sample
- No field list published
◱Screenshot
☷Mapped techniques
Mapped from the actor's own account. Claimed, not confirmed.
- Initial access T1199 Trusted relationship Stated Data was taken from a third party that handled exports for the retailer, not from the retailer itself.
- Initial access T1190 Exploit public facing application Stated Actor claims injection flaws on internet reachable endpoints.
- Execution T1059 Command and scripting interpreter Stated Injection was escalated to command execution against the database.
- Persistence T1505 Server software component Inferred Access described as held for around a month and still working. Mechanism not specified.
- Collection T1213 Data from information repositories Stated A full customer export was generated for every store, every day, and written to one host.
- Exfiltration T1048 Exfiltration over alternative protocol Stated Files were retrieved from an unauthenticated FTP host outside France.
⚠Potential impact
No fields are disclosed, so the contents remain unestablished and scale is the only firm number. What distinguishes this listing is the described mechanism. If a supplier really was writing a full customer export for every store, every day, to an unprotected external server, then the exposure is continuous rather than a single event, and the data would have been retrievable by anyone who found the host at any point in that arrangement. The claim of persistence still working at the time of posting means, if accurate, that collection may not have stopped. The wider concern is the same one raised by this actor's other listing hours earlier: an intermediary handling data for a franchise network is likely to serve other clients too, so the retailer named here may be one of several affected by a single supplier failure.
iStatus Unverified
This post supplies the mechanism that the same actor's beauty retailer listing, published nineteen minutes later, only gestured at, and the two should be read together. The technical account is specific and self consistent, which is a point in its favour, but it is also entirely uncorroborated and describes the actor's own conduct, so it may be embellished to raise the asking price. No intermediary is named anywhere in the post. A ten thousand record sample is publicly downloadable and would settle the field question, though Dark Web Informer has not retrieved it and is not linking those mirrors, nor the contact address. The claim is unverified and neither the retailer nor any supplier has publicly addressed it.
Dark Web Informer // Threat Intelligence
