Loading story…
A threat actor using the alias "misere" is offering what they claim is Bureau Vallée customer data allegedly obtained from a third-party supplier rather than the retailer itself. The seller claims the supplier exported customer data for each store daily to an unprotected external server or FTP service hosted outside France, yielding 13,725,669 total records and 4,819,927 unique records. A 10,000-record sample was reportedly published, but no field list was disclosed and the claims remain unverified.
The actor further alleges they exploited injection flaws on internet-facing systems to achieve command execution and maintain persistent access for about a month, with access still active at the time of posting. If confirmed, the incident would reflect a trusted-relationship/supply-chain compromise in which a downstream organization is exposed through a service provider’s insecure workflow, a pattern seen in broader intrusions involving managed service providers, cloud partners, and software suppliers such as SolarWinds, where compromise of an intermediary enabled access to multiple customer environments.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
On August 21, 2026, the "misere" forum listing offering alleged Bureau Vallée customer data was observed. The seller claimed 13,725,669 total records, reduced to 4,819,927 unique records, and reportedly published a 10,000-record sample.
The SolarWinds Orion supply-chain attack was disclosed in December 2020. Reporting described trojanized Orion builds, SUNBURST activity, and broad downstream impact across U.S. government and private-sector victims.
The SolarWinds Orion compromise began being exploited in spring 2020, using trojanized Orion software updates to deliver the SUNBURST backdoor to victims. The campaign affected government and private-sector organizations worldwide.
A forum user using the alias "misere" claimed to have exploited injection flaws in a third-party supplier environment, gained command execution, and maintained persistent access for about a month. The actor alleged the supplier exported Bureau Vallée customer data daily to an unprotected external server hosted outside France.
SUPERNOVA was identified in Orion artifacts as a webshell enabling arbitrary code execution on affected machines. Microsoft assessed it was likely the work of a different adversary than the actor behind the FireEye and U.S. government intrusions.
SolarWinds released Orion version 2020.2.1 HF 2 as a fix for the compromised update chain affecting specific Orion versions. The release was presented as the remediation for the supply-chain compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
darkwebinformer.com
Open sourcedarkwebinformer.com
Open sourcecyfirma.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dark web monitoring reports described **unverified data leak claims** involving several organizations, including French parcel delivery firm **Colis Privé**. One post on **BreachForums** allegedly offered an upload of **22,564,381 records** attributed to Colis Privé, described as `.jsonl` files totaling **~4.1 GB**; no specific threat actor attribution or company confirmation was cited, and the notice characterized the situation as informational while scope is assessed. If authentic, the scale and format of the dataset would materially increase risk of **identity theft, credential stuffing, and targeted phishing** against customers. Separate dark web forum posts also alleged database exposures affecting **JobsGO** (Vietnam recruitment platform), **MyVete** (veterinary management platform), **PIXPAY** (Senegalese payment service), and **Groupe Fondasol** (France-based engineering). The claimed datasets reportedly include **CV/personal records**, and in some cases **API credentials and employee metadata**, with example figures including **~2.3 million records** for JobsGO and **~5.57 million records** for MyVete (verification not indicated). Across the claims, the primary business risk is downstream abuse of exposed personal and operational data for **social engineering, recruitment fraud, and account takeover**, rather than immediate exploitation of a specific software vulnerability.
Jun 29, 2026
Dark web monitoring reports surfaced multiple **alleged data leaks** affecting unrelated organizations, with several listings offering databases for sale or direct download. Reports claim **Republic (republic.com)** user data (~4.94M users) was listed for sale for **$2,400**, allegedly including names, emails, physical addresses, and phone numbers. Separate dark web listings also alleged exposure of **rueducommerce.fr** user data (linked in reporting to **Carrefour**) totaling ~2.17M records with similar PII, as well as alleged leaks involving **Dunzo** (~3.4M records) and **Menulux** (~93K records). Additional reporting highlighted a historical breach dataset for the **YouHack** forum (2013; ~107K users) containing usernames, emails, passwords, IPs, posts, and private messages, and a smaller exposure tied to **buylottoonline.com** (~38.5K email records). One of the most consequential claims involved **Salesfloor / People Powered E-Commerce (salesfloor.net)**, attributed in reporting to **LAPSUS$**, alleging theft of roughly **4 TB uncompressed** (1 TB compressed) data including **source code, logs, and customer information**, with potential downstream impact to retail brands using the platform. Separately from the dark-web-leak theme, other items in the set describe distinct vulnerability-driven risks rather than breach listings: **Zoom Node MMRs** command injection (**CVE-2026-22844**, CVSS 9.9) enabling arbitrary code execution in certain hybrid meeting deployments; **SmarterMail** auth bypass (**CVE-2026-23760**) enabling admin password reset via `force-reset-password` and potential RCE; **Vite** improper access control (**CVE-2025-31125**) enabling sensitive file exposure via query parameters such as `?inline&import` / `?raw&import` (noted as added to CISA KEV); and **Appsmith** password-reset token exposure (**CVE-2026-22794**) enabling account takeover, with internet-exposed instances identified via Shodan and remediation via upgrade to *Appsmith* 1.93. These vulnerability reports are separate from the dark web leak claims and should be tracked as independent patching priorities rather than as part of a single breach event.
Jun 29, 2026
Threat actor **HexDex** has claimed breaches at two French e-commerce companies and is offering the allegedly stolen data for sale. One listing targets **Airsoft-Entrepot**, where the actor says it obtained more than 10 database files covering 2013 to 2026, including roughly **383,000 customer profiles**, **328,000 email addresses**, **243,000 phone numbers**, and **333,000 full address records**. The exposed material reportedly goes beyond customer PII to include **orders, invoices, supplier data, delivery history, accounting records, B2B orders, and warehouse or inventory information**, suggesting compromise of both customer-facing and back-office systems. A second listing targets **Allopneus**, a major French online tire retailer, with HexDex claiming to hold data spanning 2014 to 2026 for **453,299 customers** across **739,316 records**, including **513,089 phone numbers** and **453,299 email addresses**. The actor reportedly published proof links, sample records, and 1,000-line excerpts for both datasets while soliciting offers through underground channels. If authentic, the disclosures would expose large volumes of customer contact data and purchase-related information, while the Airsoft-Entrepot cache could also reveal sensitive supplier, financial, and logistics details that increase fraud, phishing, and business intelligence risks.
Jun 29, 2026