Planity Database Allegedly for Sale, 999,451 Customers of French Salons and Spas Listed

◱Screenshot

Screenshot 1 Redacted preview

⚠Potential impact

This is a contact dataset rather than a credential one: no passwords, payment details, or appointment histories appear in the sample, and the direct fraud risk is correspondingly limited. Its value to a buyer lies in quality rather than depth. A verified mobile number attached to a real name, for a population of roughly a million French consumers, is a strong input for SMS-based fraud, and appointment reminders are a message type these customers are conditioned to receive and act on. The business identifier is what makes the set more than a generic contact list. Because each customer is mapped to the specific salon or spa they booked with, a fraudulent message can name the establishment a person actually uses, which removes the main cue people rely on to spot impersonation. That linkage also creates a modest privacy exposure in its own right, since beauty and wellness patronage is not something everyone treats as public, and certain categories of clinic carry more sensitivity than a hairdresser does. Two structural details deserve attention. The presence of deletion timestamps suggests records marked as deleted remain present in the export, which raises a question about whether individuals who exercised erasure rights are still represented in the data; soft deletion is a routine engineering pattern and not in itself a violation, but under GDPR it becomes a question the operator would need to answer. The sample also contains at least one address on the platform's own corporate domain, indicating staff or test records are mixed into the customer set. The claim is unverified.