Nearly 23 million motorists could be affected by a new data breach in France. A hacker claims to possess a vast database linked to SGS group’s vehicle inspection networks.
This claim, revealed in early November 2026, adds to cyberattacks targeting car reservations, a bank and refrigeration equipment. The techniques used and the individuals identified, however, differ markedly from one case to another.
The essentials
The hacker claims about 22.7 million people are affected, though there is no definitive public confirmation.
The method of intrusion into the affected systems has not been established.
Other recent attacks are better documented: a financial diversion via a banking service provider and fridge sabotage attributed to Iran by French authorities, an accusation rejected by Tehran.
A database attributed to SGS’s vehicle inspection networks
According to information reported on November 9, 2026 by TF1 and by the expert ZATAZ, a hacker using the pseudonym ChimeraZ claims to have obtained a database linked to the French activities of SGS. The group is active in automotive inspection through, notably, Sécuritest, Auto Sécurité and Vérif’Autos.
The author of the claim mentions about 22.7 million people. The information involved could include names, postal addresses, phone numbers, emails, license plates and data related to vehicles and inspections. Billing elements would also be among the files announced.
Three elements must be distinguished: the hacker’s claim, the samples presented to support it and the confirmation by the relevant organization. The number of people actually affected has not been publicly confirmed definitively by SGS or the CNIL in the materials consulted. Historical databases can also contain repeated records.
How this hacking was carried out?
At this stage, the exact entry point is not known. No publicly supported source allows us to assert that the attackers exploited a specific vulnerability, stole a password, or breached a SGS supplier.
Nevertheless, sector dynamics help explain why the data could be numerous: a vehicle inspection center sometimes uses software for reservations, SMS reminders, billing and case management.
These tools can aggregate information from several establishments. A compromise of a shared system could therefore affect a large number of files. This is a general explanation of the risk, not a verified reconstruction of this attack.
Auto-Planning: a previous claim involving 18 million people
A few days earlier, on October 24, the ChimeraZ pseudonym already surfaced in a case involving Auto-Planning, a booking provider for vehicle inspections. According to FrenchBreaches, cited by L’Argus, the hacker claimed access to information linked to around 13.9 million license plates and 18 million people, as well as a substantial appointment history.
Auto-Planning acknowledged a cybersecurity incident, but the claimed volumes remain to be distinguished from a definitive and verified assessment. Potential data include client contact details, vehicle characteristics and appointment dates.
The two cases should not be added together to announce more than 40 million victims: records may overlap and the use of the same pseudonym is not enough to establish the details of a joint intrusion.
Crédit Mutuel Arkéa: around 100 million euros at stake
On November 4, Crédit Mutuel Arkéa confirmed fraudulent transactions carried out from an account belonging to the bank. The funds were transferred to other institutions; they could then have been converted into cryptocurrencies.
The institution explained that the attackers went through the platform of one of its service providers, and not through the accounts of Fortuneo clients or other entities within the group. Client balances were not touched, according to the bank, even if some transfers were temporarily delayed.
Reuters cites a figure of around €100 million. The bank confirmed the scale of the incident, without issuing a definitive tally of losses after potential fund recovery. The identity and country of origin of the perpetrators have not been publicly established.
Sabotaged refrigerators: France attributes the attack to an Iranian unit
The series of incidents also affects physical infrastructure. On November 9, France officially attributed to the cyber-offensive unit Shahid Kaveh, linked, according to France, to the Islamic Revolutionary Guard Corps, an attack conducted in the night of October 11–12 against the cooling systems of approximately 700 large-distribution sites.
According to the National Agency for Information Systems Security (ANSSI), the attackers remotely altered defrost settings, causing merchandise losses and at least 15 fires. The French attribution rests on a set of technical indicators, including the infrastructure used, recognizable tools and traces of Persian language.
On November 10, Iran rejected these accusations. Other incidents involving refrigerators were reported in early November in Europe, but they cannot be automatically attributed to the same unit based on the information available.
Different authors and targets
The breaches claimed in the vehicle inspection sector resemble operations aimed at databases that could be sold or used for fraud. In the Arkéa case, the established fact is the execution of fraudulent transactions from a bank account. Investigations into the authors continue. For refrigerators, French authorities speak of sabotage and point to an Iranian unit; Tehran disputes this attribution.
An overseas IP address, a group name or a claim message are not, by themselves, sufficient to prove a hacker’s nationality or state involvement. Certainty levels are therefore very different across cases.
What risks for drivers and how to respond?
The main danger is personalized phishing: a fake SMS about a fine, a message announcing vehicle registration fees or a reminder of a vehicle inspection can look credible if it mentions the recipient’s real name or their vehicle’s license plate. The data can also facilitate certain identity or plate fraud attempts.
In France, it is advised to check fines directly on the official site amendes.gouv.fr, rather than using a link from a suspicious SMS; never share banking codes in a rush; and report fraudulent SMS at 33700. In case of a suspect debit, one should contact their bank immediately.
Tunisians residing in France and using the relevant inspection networks may face the same risks. However, nothing in this case allows confirming that the vehicle registration databases or the inspection centers in Tunisia were compromised.
These events illustrate three distinct risks: data theft, misuse of financial access, and sabotage of connected equipment. The response involves protecting personal information, exercising oversight of service providers, and securing industrial systems.
