France
Retail / Supplier Compromise
Price By Offer
Bureau Vallée Customer Data Allegedly Taken From a Supplier That Exported Every Store Daily
A forum user posting as misere is selling what they describe as the customer database of bureau-vallee.fr, a French office supplies chain, listing 13,725,669 total records reducing to 4,819,927 unique. The seller does not claim to have breached the retailer. They describe taking the data from a third party that generated a daily customer export for each store and placed the files on an external server, said to be hosted outside France without protection. They further claim to have exploited injection flaws to obtain command execution and establish persistent access held for around a month and still working. A 10,000 record sample is published, but no field list is given. The claim is unverified.
▣Post details
France!What the post claims
- 13.73M total records
- 4.82M unique records
- Daily per store exports
- Customer data in each file
- Files placed on an FTP host
- Server outside France
- No protection on that host
- Injection flaws on endpoints
- Database command execution
- Persistent access established
- Access held about a month
- Access claimed still live
- 10,000 record sample
- No field list published
◱Screenshot
⚠Potential impact
No fields are disclosed, so the contents remain unestablished and scale is the only firm number. What distinguishes this listing is the described mechanism. If a supplier really was writing a full customer export for every store, every day, to an unprotected external server, then the exposure is continuous rather than a single event, and the data would have been retrievable by anyone who found the host at any point in that arrangement. The claim of persistence still working at the time of posting means, if accurate, that collection may not have stopped. The wider concern is the same one raised by this seller's other listing hours earlier: an intermediary handling data for a franchise network is likely to serve other clients too, so the retailer named here may be one of several affected by a single supplier failure.
iStatus
UnverifiedThis post supplies the mechanism that the same seller's beauty retailer listing, published nineteen minutes later, only gestured at, and the two should be read together. The technical account is specific and self consistent, which is a point in its favour, but it is also entirely uncorroborated and describes the seller's own conduct, so it may be embellished to raise the asking price. No intermediary is named anywhere in the post. A ten thousand record sample is publicly downloadable and would settle the field question, though Dark Web Informer has not retrieved it and is not linking those mirrors, nor the contact address. The claim is unverified and neither the retailer nor any supplier has publicly addressed it.
DARK WEB INFORMER - THREAT INTELLIGENCE
