French Police File Queries Allegedly Taken Through the Calypsso Portal
A forum user posting as DumpSecNew is selling what they describe as data drawn from Portail Calypsso, an access portal used to query French national police systems. The post names TAJ, FPR, SIV and SNPC among the files reached, and the published sample takes the form of query results rather than a table dump, returning identity records, family links, addresses and listed offences for the person searched. The actor attributes the data to a cybersecurity incident in August 2026 and does not describe how access was obtained. The asking price is 8,500 euros, negotiable, in Monero. The claim is unverified.
▣Post details
!What the post claims
- Data from Portail Calypsso
- Incident dated August 2026
- TAJ criminal records
- FPR wanted persons file
- SIV vehicle registration
- SNPC named among files
- Schengen queries returned
- FOVeS vehicle queries
- Identity records with ages
- Places and dates of birth
- Home addresses
- Parent names as filiation
- Coded offence references
- Query timestamps retained
- Price 8,500 EUR negotiable
- Monero only
◱Screenshot
☷Mapped techniques
Mapped from the actor's own account. Claimed, not confirmed.
- Initial access T1078 Valid accounts Inferred The sample is portal output, not a database export, so it was produced by something able to run authorised queries. No mechanism is described.
- Collection T1213 Data from information repositories Stated Results are drawn from several national files through one interface.
- Collection T1119 Automated collection Inferred Structured output with per file result counts and timestamps is consistent with scripted querying rather than manual lookups.
- Exfiltration T1567 Exfiltration over web service Inferred Samples are circulated through forum hosting. The route out of the environment is not described.
⚠Potential impact
What is on offer here is not a customer list. The files named cover judicial antecedents, wanted persons, vehicle registration and licensing, and the sample shows them returned together against a single individual, with family links and addresses attached. Data of this kind cannot be reissued the way a password or a card number can, and the people in it are not customers who opted into anything. They are suspects, convicted persons, victims and witnesses, some of whom appear in these files precisely because they are at risk from someone. A working query capability against the wanted persons file also has an obvious operational value to anyone who wants to know whether they, or someone they work with, is being looked for. The wider question is how the queries were being run and by whom, because portal output implies credentials, and credentials imply either a compromised account or a person willing to use theirs. Neither is addressed in the post.
iStatus Unverified
This listing arrives with a dispute already attached to it. The actor uses the post to accuse another party of taking their samples from a different forum, altering them, and reselling the result, and states that the account involved has been banned. Whatever the merits, the practical effect is that more than one version of this data is in circulation and at least one of them is described as modified, which makes any sample checked against reality a weak test of the whole. The account posting is new, with a single thread and no reputation. Against that, the sample structure is internally consistent and matches how portal output would look, which is a point in its favour and nothing more. Dark Web Informer has not retrieved the samples and is not linking them, nor the contact address, and has redacted the personal data visible in the post. No French authority has publicly addressed the claim.
Dark Web Informer // Threat Intelligence
