> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# French Restaurant Platform FrenchInnov Allegedly Scraped, Exposing Client Credentials and Live Payment Keys
- URL: https://darkwebinformer.com/french-restaurant-platform-frenchinnov-allegedly-scraped-exposing-client-credentials-and-live-payment-keys/
- Published: 2026-08-20T19:00:55.000Z
- Updated: 2026-08-20T19:00:55.000Z
- Author: Dark Web Informer
- Tags: Cybercrime

Breach Report ![France flag](https://flagcdn.com/w40/fr.png)France Restaurant Software / Supply Chain Free Download 

## French Restaurant Platform FrenchInnov Allegedly Scraped, Exposing Client Credentials and Live Payment Keys

A forum user posting as **Alduin** claims to have scraped the CRM behind **frenchinnov.fr**, a French platform that centralises restaurant operations including point of sale, stock, staff planning, loyalty and delivery platform integration. The set is small at roughly **1,600 client records across two JSON files**, but the contents are not. A free text notes field carries, in plain view, **remote access passwords, database server credentials, email account passwords and live payment gateway secret keys** belonging to the restaurants themselves. Records also include business identifiers, addresses and terminal hardware references. The actor states the data was **scraped rather than extracted through an intrusion**. The claim is **unverified**.

Severity CRITICAL 

[ ![WhiteIntel sponsor banner](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) 

Client records1,600

CredentialsIn plain text

Datasets2 JSON files

ActorAlduin

### ▣Post details

Targetfrenchinnov.fr

Country![France flag](https://flagcdn.com/w40/fr.png)France

SectorRestaurant management SaaS

ListingFree, reply to unlock

Volume883KB plus 1,067KB JSON

MethodClaimed scraping

ObservedAug 20, 2026

ActorAlduin

### !Allegedly included

- Business names and branding
- Client reference codes
- Business street addresses
- Phone numbers
- Contact email addresses
- Remote access passwords
- Database server credentials
- Email account passwords
- Live payment secret keys
- Publishable payment keys
- Point of sale terminal IDs
- Kiosk and screen device refs
- SIREN and SIRET numbers
- VAT registration numbers

### ◱Screenshots

[ ![FrenchInnov France restaurant CRM data leak forum post screenshot, August 2026](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/08/9823589762379856928376598273598723.png) Screenshot 1 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/08/9823589762379856928376598273598723.png) [ ![Claimed record structure for the second FrenchInnov dataset](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/08/9823589762379856928376598273598724.png) Screenshot 2 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/08/9823589762379856928376598273598724.png) 

### ⚠Potential impact

The record count is trivial and the severity is not, because this is **a supplier exposure that hands over the customers rather than the supplier**. Support notes appear to have been used as a credential store, so a single file reportedly yields, per restaurant, the password to **take remote control of the till system, the login to its database, the mailbox password, and the secret key to its payment account**. A live payment secret key is an instrument rather than a record, allowing an account to be read and refunds to be issued until it is rotated. Remote access to a point of sale terminal is worse still, since it puts an attacker on the device that handles cards in person. Every affected restaurant should treat **every credential ever shared with the vendor as burned** and rotate payment keys, remote access passwords, database logins and mailbox passwords now, regardless of whether the claim is later confirmed.

### iStatus

Unverified 

The word the actor uses matters. **Scraping implies an interface returning client records to whoever asked**, rather than a break in, which would point to a missing authorisation check on a CRM endpoint and would mean the door may still be open. The samples are internally consistent and the field structures match a French business context, with company registration and VAT identifiers formatted correctly. Those identifiers are matters of public record in France, so **the harm sits in the credentials beside them, not in the company data itself**. Dark Web Informer is **not reproducing the credentials, payment keys, terminal identifiers or client details** visible in the samples. The claim is **unverified** and the vendor has not publicly addressed it.

Want everything on this breach? **Paid subscribers** get the full claim details and more. Check out the [threat feed](https://darkwebinformer.com/threat-feed/), then after subscribing, search there for this alert. [View pricing →](https://darkwebinformer.com/pricing) 

[DARK WEB INFORMER](https://darkwebinformer.com/) \- THREAT INTELLIGENCE