France
Restaurant Software / Supply Chain
Free Download
French Restaurant Platform FrenchInnov Allegedly Scraped, Exposing Client Credentials and Live Payment Keys
A forum user posting as Alduin claims to have scraped the CRM behind frenchinnov.fr, a French platform that centralises restaurant operations including point of sale, stock, staff planning, loyalty and delivery platform integration. The set is small at roughly 1,600 client records across two JSON files, but the contents are not. A free text notes field carries, in plain view, remote access passwords, database server credentials, email account passwords and live payment gateway secret keys belonging to the restaurants themselves. Records also include business identifiers, addresses and terminal hardware references. The actor states the data was scraped rather than extracted through an intrusion. The claim is unverified.
▣Post details
France!Allegedly included
- Business names and branding
- Client reference codes
- Business street addresses
- Phone numbers
- Contact email addresses
- Remote access passwords
- Database server credentials
- Email account passwords
- Live payment secret keys
- Publishable payment keys
- Point of sale terminal IDs
- Kiosk and screen device refs
- SIREN and SIRET numbers
- VAT registration numbers
◱Screenshots
⚠Potential impact
The record count is trivial and the severity is not, because this is a supplier exposure that hands over the customers rather than the supplier. Support notes appear to have been used as a credential store, so a single file reportedly yields, per restaurant, the password to take remote control of the till system, the login to its database, the mailbox password, and the secret key to its payment account. A live payment secret key is an instrument rather than a record, allowing an account to be read and refunds to be issued until it is rotated. Remote access to a point of sale terminal is worse still, since it puts an attacker on the device that handles cards in person. Every affected restaurant should treat every credential ever shared with the vendor as burned and rotate payment keys, remote access passwords, database logins and mailbox passwords now, regardless of whether the claim is later confirmed.
iStatus
UnverifiedThe word the actor uses matters. Scraping implies an interface returning client records to whoever asked, rather than a break in, which would point to a missing authorisation check on a CRM endpoint and would mean the door may still be open. The samples are internally consistent and the field structures match a French business context, with company registration and VAT identifiers formatted correctly. Those identifiers are matters of public record in France, so the harm sits in the credentials beside them, not in the company data itself. Dark Web Informer is not reproducing the credentials, payment keys, terminal identifiers or client details visible in the samples. The claim is unverified and the vendor has not publicly addressed it.
DARK WEB INFORMER - THREAT INTELLIGENCE
