ShredRGPDFR
Write my letter
Figures

Data breaches in France, in figures

What the public Have I Been Pwned catalogue says about the breaches that hit French companies. Filter by year or by type of data: all the figures follow. Updated every day.

29 breaches

breaches of French companies since 2014
29
of more than a million accounts
14
contain bank details
10%
between a breach and its arrival in the catalogue (median)
5 months

Breaches per year

By the year the breach happened, not the year it was discovered: the last few years are incomplete. Click a year to filter the page; hover to see its breaches.

  1. 1 breach in 2014Domino's
  2. 2 breaches in 2015Pokébip, Minefield
  3. 1 breach in 2016Dailymotion
  4. 1 breach in 2017Appartoo
  5. 1 breach in 2018Pemiblanc
  6. 2 breaches in 2019Artvalue.com, Deezer
  7. 1 breach in 2020WiziShop
  8. 2 breaches in 2021Short Édition, Bourse des Vols
  9. 2 breaches in 2022La Poste Mobile, MacGeneration
  10. 2 breaches in 2023Zadig & Voltaire, Fédération Francaise de Rugby
  11. 7 breaches in 2024Free, Boulanger, Cultura, Assurance Retraite, Sport 2000, Le Slip Français and 1 others
  12. 4 breaches in 2025Pass'Sport, Eurofiber, Bouygues Telecom, AUTOSUR
  13. 3 breaches in 2026Questel, Gîtes de France, Association Nationale des Premiers Secours

The most exposed data

Share of the breaches that contain each type of data. Click a type to filter the page.

34% of these breaches contain passwords. Did you reuse one? Test it without handing it to anyone.

The biggest breaches

Number of accounts exposed. Each breach has its own page: what leaked and what to do.

  1. DeezerApr 2019229 million
  2. PemiblancApr 2018111 million
  3. DailymotionOct 201685.2 million
  4. FreeOct 202413.9 million
  5. Pass'SportDec 20256.4 million
  6. Bouygues TelecomAug 20255.7 million
  7. Sport 2000Apr 20243.2 million
  8. WiziShopJul 20202.9 million
  9. BoulangerSep 20242.1 million
  10. Le Slip FrançaisApr 20241.5 million

All breaches

Click a column heading to sort.

Exposed data
QuestelAug 20261,226,209email addresses, employers, job titles, names, phone numbers, physical addresses, support tickets
Gîtes de FranceMay 2026117,574booking details, email addresses, names, phone numbers, physical addresses
Association Nationale des Premiers SecoursJan 20265,600dates of birth, email addresses, names, places of birth, salutations
Pass'SportDec 20256,366,133email addresses, genders, names, phone numbers, physical addresses
EurofiberNov 202510,003email addresses, names, phone numbers
Bouygues TelecomAug 20255,685,771bank account numbers, dates of birth, email addresses, names, phone numbers, physical addresses
AUTOSURMar 2025487,226email addresses, names, phone numbers, physical addresses, vehicle details, vehicle identification numbers (VINs), vehicle registration plates
FreeOct 202413,926,173bank account numbers, dates of birth, genders, names, phone numbers, physical addresses
BoulangerSep 20242,077,078email addresses, geographic locations, latitude and longitude pairs, names, phone numbers, physical addresses
CulturaSep 20241,462,025email addresses, names, phone numbers, physical addresses, purchases
Assurance RetraiteSep 202470,372dates of birth, email addresses, family members' names, government issued IDs, income levels, marital statuses, names, phone numbers, physical addresses
Sport 2000Apr 20243,189,643dates of birth, email addresses, names, phone numbers, physical addresses, purchases, salutations
Le Slip FrançaisApr 20241,495,127email addresses, names, phone numbers, physical addresses
LDLCFeb 20241,266,026email addresses, names, phone numbers, physical addresses, salutations
Zadig & VoltaireNov 2023586,895email addresses, genders, names, phone numbers, physical addresses
Fédération Francaise de RugbyJul 2023281,977dates of birth, email addresses, names, phone numbers
La Poste MobileJul 2022533,886bank account numbers, dates of birth, email addresses, genders, names, phone numbers, physical addresses
MacGenerationJan 2022101,004email addresses, passwords, usernames
Short ÉditionJun 2021505,466dates of birth, email addresses, genders, names, passwords, phone numbers, physical addresses, social media profiles, usernames
Bourse des VolsJan 20211,460,130dates of birth, email addresses, flights taken, IP addresses, names, phone numbers, physical addresses, purchases
WiziShopJul 20202,856,769dates of birth, email addresses, IP addresses, names, passwords, phone numbers, physical addresses
Artvalue.comJun 2019157,692email addresses, names, passwords, salutations, usernames
DeezerApr 2019229,037,936dates of birth, email addresses, genders, geographic locations, IP addresses, names, spoken languages, usernames
PemiblancApr 2018110,964,206email addresses, passwords
AppartooMar 201749,681ages, auth tokens, email addresses, employment statuses, genders, IP addresses, marital statuses, names, passwords, physical addresses, private messages, social media profiles
DailymotionOct 201685,176,234email addresses, passwords, usernames
PokébipJul 2015657,001email addresses, IP addresses, passwords, time zones, usernames, website activity
MinefieldJun 2015188,343dates of birth, email addresses, IP addresses, passwords, usernames, website activity
Domino'sJun 2014648,231email addresses, names, passwords, phone numbers, physical addresses

How to read these figures

  • “French” is an estimate. The catalogue gives no country. ShredRGPD counts a breach if the company’s domain ends in .fr, if the company is known to be French or if the description mentions France. Some breaches are surely missing, others may be counted wrongly.
  • Only breaches known to Have I Been Pwned. The catalogue only lists breaches whose data circulated and were loaded into it. It is not the total number of breaches that hit France.
  • Accounts, not people. The same person can appear in several breaches, and an account is not always a person. Adding up accounts does not give the number of people affected in France.
  • Scope: breaches with an identified company, excluding spam lists, malware and breaches flagged as fabricated.

Source: Have I Been Pwned, under the CC BY 4.0 licence, catalogue of 30 October 2026. This is public information about the breaches, never the breached data. The filters stay in your browser.

Check my breaches