Réso Files Totalling 675 GB Offered for Sale After a Silent Period Ends
A forum actor posting as caustic claims to hold 675 GB taken from the network of Réso, a French supplier of construction products including ceilings, partitions, floors and facades, with agencies across the country. The post gives roughly 43,000 folders and 530,000 files, publishes a complete file listing along with one user folder as a sample and several mirrors, and describes the contents as invoices, customer records, partner data, private conversations, orders, business strategy documents and technical drawings. The wording indicates a period of silence on both sides before publication, which the actor now ends by inviting buyers. The claim is unverified.
▣Post details
!What the post claims
- 675 GB of data
- About 43,000 folders
- About 530,000 files
- Complete file listing published
- One user folder as a sample
- Several mirrors offered
- Invoices
- Customer records
- Partner data
- Private conversations
- Orders
- Business strategy documents
- Technical drawings
- Access described as network wide
- Silence before publication
- Now offered to buyers
- Escrow suggested
- Contact by messenger only
◱Screenshot
☷Mapped techniques
Mapped from the actor's own account. Claimed, not confirmed.
- Collection T1039 Data from network shared drive Inferred Volume expressed in folders and files, with an individual user folder offered as a sample, describes a file share rather than an application or database.
- Collection T1213 Data from information repositories Stated The actor lists finance, sales, partner and engineering material together, which spans several internal systems rather than one.
- Exfiltration T1567 Exfiltration over web service Inferred Listings and samples are distributed through several public file hosts. The route out of the environment is not described.
- Impact T1657 Financial theft Inferred The reference to mutual silence now ending, followed by an invitation to buyers, is the familiar shape of a private demand that produced no payment.
⚠Potential impact
Publishing a complete file listing is itself an act with consequences, because it maps the company's internal structure and tells anyone else looking exactly what exists and where, whether or not they ever obtain the archive. The categories named go well beyond privacy: private conversations and strategy documents carry commercial and legal exposure, and invoices, orders and partner records extend it to counterparties across a construction supply chain who had no involvement. Technical drawings are the quiet risk, since for a facades and partitions supplier they describe how specific buildings are put together.
iStatus Unverified
This listing is more checkable than most, since a full index and a complete sample folder are published, so the structure and the file names can be examined by anyone willing to, and a fabricated set of that size would be difficult to sustain. The timeline is the notable part: the phrasing about mutual silence now ending indicates a private approach to the company before this post, which is the standard pattern when a demand goes unpaid. The account is established with a paid rank and a short history. Dark Web Informer has not retrieved the files and is not linking them, nor the contact address, and Réso has not publicly addressed the claim.
Dark Web Informer // Threat Intelligence
