France
Automotive Services
Customer, Vehicle & Financial Data
Leak Claim
Unverified
France Pare-Brise Data Breach Claim Includes 38,382 Files With Customer, Vehicle and Banking Information
Overview
An actor using the handle "TimeSape" is publicizing a breach claim involving France Pare-Brise, a French vehicle-glass repair and replacement company. The post attributes the breach to "LunarisSec" and says the attackers were able to extract more than 100,000 users' records.
The listing claims a folder containing 38,382 files totaling approximately 2.06 GB. The visible field list includes customer names, postal addresses, phone numbers, email addresses, dates and places of birth, driving-licence numbers, vehicle registration data, VINs, mileage, insurance information, claim and repair details, invoice numbers, amounts, banking fields including IBAN, and other order-related information. The post also states that the material contains more sensitive documents such as identity cards and driver's licences. The dataset, its source, the stated counts and the claimed breach attribution have not been independently verified.
Post details
FranceWhat the post claims
- More than 100,000 user records extracted
- 38,382 files advertised
- 2.06 GB folder size
- Customer first and last names listed
- Postal addresses and city fields listed
- Phone and mobile-number fields listed
- Email addresses listed
- Date and place of birth fields listed
- Driving-licence number fields listed
- Vehicle registration and VIN fields listed
- Vehicle make, model, mileage and fuel-type fields listed
- Insurance contract, policy and claim fields listed
- Invoice numbers and financial amounts listed
- IBAN field listed
- Repairer and expert information listed
- Identity-card and driver's-licence documents also claimed
The screenshot also shows a second file-count figure of 4,943 alongside the larger 38,382-file figure, but the supplied material does not explain the relationship between those two counts. No personal values from the purported dataset are transcribed in this report.
Screenshots
IOCs & contact identifiers
Identifiers directly visible or supported by the supplied material. These support correlation and do not independently verify the dataset claim.
| Type | Identifier | Source |
|---|---|---|
| Actor handle | TimeSape | Screenshot 1 |
| Attributed group | LunarisSec | Screenshot 1 |
| Named organization domain | franceparebrise[.]fr | Screenshot 1 |
The domain identifies the organization named in the claim, not malicious infrastructure. A direct link to the purported leaked material is visible in the source screenshot but is intentionally not reproduced here. No Tox ID, Session ID, malware hash or attacker-controlled IP address is visible. Customer identifiers shown or referenced in the purported evidence are not included in this table. URLs to any data will always be blurred out, but are available for subscribers on the threat feed or ransomware feed.
Mapped techniques
Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.
- Collection T1213.006 Data from Information Repositories: Databases Inferred The listing presents a large structured set of customer, vehicle, insurance, repair and financial fields. The supplied material does not disclose the acquisition method or independently establish unauthorized access to France Pare-Brise systems.
Potential impact
If authentic, the claimed dataset could expose names, addresses, phone numbers, email addresses, birth information, driving-licence numbers, vehicle identifiers, insurance records and banking details. The combination could support targeted phishing, identity fraud, insurance fraud, financial abuse or other forms of impersonation involving affected customers.
Status Unverified
Dark Web Informer has not independently verified the dataset's authenticity, source, 2.06 GB size, 38,382-file count, 100,000+ user-record claim, current availability or the attribution to LunarisSec. The supplied screenshot documents the listing and field structure, not independent confirmation of the underlying material.
