> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Bureau Vallée Customer Data Allegedly Taken From a Supplier That Exported Every Store Daily
- URL: https://darkwebinformer.com/bureau-vallee-customer-data-allegedly-taken-from-a-supplier-that-exported-every-store-daily/
- Published: 2026-08-21T18:07:58.000Z
- Updated: 2026-08-21T18:07:58.000Z
- Author: Dark Web Informer
- Tags: Data Breaches

Breach Report ![France flag](https://flagcdn.com/w40/fr.png)France Retail / Supplier Compromise Price By Offer 

## Bureau Vallée Customer Data Allegedly Taken From a Supplier That Exported Every Store Daily

A forum user posting as **misere** is selling what they describe as the customer database of **bureau-vallee.fr**, a French office supplies chain, listing **13,725,669 total records reducing to 4,819,927 unique**. The seller does not claim to have breached the retailer. They describe taking the data from **a third party that generated a daily customer export for each store and placed the files on an external server**, said to be hosted outside France without protection. They further claim to have exploited injection flaws to obtain command execution and establish **persistent access held for around a month and still working**. A 10,000 record sample is published, but **no field list is given**. The claim is **unverified**.

Severity HIGH 

[ ![WhiteIntel sponsor banner](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) 

Unique records4,819,927

Total records13.73M

AccessClaimed ongoing

Actormisere

### ▣Post details

Targetbureau-vallee.fr

Country![France flag](https://flagcdn.com/w40/fr.png)France

SectorOffice supplies retail

ListingSelling, price by offer

Volume4.82M unique of 13.73M

Stated sourceThird party exporter

ObservedAug 21, 2026

Actormisere

### !What the post claims

- 13.73M total records
- 4.82M unique records
- Daily per store exports
- Customer data in each file
- Files placed on an FTP host
- Server outside France
- No protection on that host
- Injection flaws on endpoints
- Database command execution
- Persistent access established
- Access held about a month
- Access claimed still live
- 10,000 record sample
- No field list published

### ◱Screenshot

[ ![Bureau Vallee France customer database sale forum post screenshot, August 2026](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/08/25798235623875698273598726359871.png) Screenshot 1 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/08/25798235623875698273598726359871.png) 

### ⚠Potential impact

No fields are disclosed, so the contents remain unestablished and **scale is the only firm number**. What distinguishes this listing is the described mechanism. If a supplier really was writing **a full customer export for every store, every day, to an unprotected external server**, then the exposure is continuous rather than a single event, and the data would have been retrievable by anyone who found the host at any point in that arrangement. The claim of **persistence still working at the time of posting** means, if accurate, that collection may not have stopped. The wider concern is the same one raised by this seller's other listing hours earlier: an intermediary handling data for **a franchise network is likely to serve other clients too**, so the retailer named here may be one of several affected by a single supplier failure.

### iStatus

Unverified 

This post supplies the **mechanism that the same seller's beauty retailer listing, published nineteen minutes later, only gestured at**, and the two should be read together. The technical account is specific and self consistent, which is a point in its favour, but it is also **entirely uncorroborated and describes the seller's own conduct**, so it may be embellished to raise the asking price. No intermediary is named anywhere in the post. A ten thousand record sample is publicly downloadable and would settle the field question, though Dark Web Informer has **not retrieved it and is not linking those mirrors**, nor the contact address. The claim is **unverified** and neither the retailer nor any supplier has publicly addressed it.

Want everything on this breach? **Paid subscribers** get the full claim details and more. Check out the [threat feed](https://darkwebinformer.com/threat-feed/), then after subscribing, search there for this alert. [View pricing →](https://darkwebinformer.com/pricing) 

[DARK WEB INFORMER](https://darkwebinformer.com/) \- THREAT INTELLIGENCE