A threat actor going by 888 has posted the full database of Ledil Immobilier (ledil.immo) on a popular cybercrime forum. Ledil Immobilier is a French real estate mandataire network founded in 2012 by Katia and Laurent Baron in Agen (Lot-et-Garonne, Nouvelle-Aquitaine) and operating nationally with more than 2,000 property listings across houses, apartments, land, and investments. The actor describes the company as "a pioneering network of free real estate agents" and states the breach occurred in April 2026.

According to the listing, the dataset contains 6,700 unique user records. The exposed schema visible in the compromised-data list and sample rows is consistent with a full export from Ledil's internal business tool, which appears to run on Drupal with the Search API (fields include search_api_solr, drupal_X2f_langcode, and entity:acquereur references). The data categories exposed include:

• Acquéreur (Buyer) RecordsFull names, email addresses, telephone numbers, addresses, nationalities, and search criteria tied to individual prospective buyers registered in Ledil's CRM.
• Mandataire & Agent DataAgent user IDs, names, emails, and telephone numbers for Ledil's network of mandataires, along with sector assignments and postal codes of their working zones.
• Notaire & Intervenant DetailsIdentifiers for notaires and other transaction intervenants, with linkages to specific property files and mandates.
• Property (Bien) RecordsProperty prices, descriptions, locations (commune, département), surface areas, legal statuses, number of rooms, energy categories, commercial status, and offer-type metadata.
• Transaction MetadataHonoraires (agent fees), mandate document numbers, boost and highlight flags, creation and update timestamps, message logs, and internal statuses for each listing.

The sample rows published by the actor include real French email addresses across commonly-used domains (wanadoo.fr, hotmail.fr, and corporate addresses such as amann-kaffee.at), first names, and Drupal entity URLs pointing to enterprise1.ledil.immo, suggesting the leak originates from an internal staging or production instance of Ledil's mandataire platform rather than from a public website. Transaction timestamps in the visible sample cluster around late 2025, consistent with the claimed April 2026 breach date. The fact that the dataset is being distributed at no cost, only gated behind basic forum registration, maximises exposure and makes retroactive containment impractical.