driving
Cybersecurity attack sees information of 847,000 French number plates reportedly for sale
Hackers also claim to have taken email addresses and telephone numbers, with information potentially being used for fake fine scams
France’s latest cyberattack has reportedly seen information relating to 847,000 number plates up for sale on a cybercriminal forum.
Information linked to a vehicle’s owner including their name, phone number, email, and postal address may all have been compromised in the attack.
Fraudsters can use this information as part of sophisticated scams, often posing as official workers to gain a victim’s trust and using the information stolen by cybercriminals to increase their credibility. Alternatively, they may be used as part of popular ‘fake fine’ scams.
The reported breach has renewed calls for people across France to stay vigilant against scams, and to be on alert for suspicious activity.
More than one million pieces of information potentially stolen
French data breach monitoring website FrenchBreaches reported the incident. A well-known hacker under the alias of ‘ChimeraZ’ claimed responsibility.
This hacker is also behind recent alleged breaches of the servers of several political parties (including La France Insoumise and Renaissance, the party of French President Emmanual Macron, which both deny being compromised) and the reported breach of the I-CAD pet database.
The hacker claimed to have 847,000 number plates, alongside 506,003 email addresses and 474,906 telephone numbers.
The hacker claimed that a file containing up to two million additional files on drivers, mostly including number plates, could be made available in the coming days.
However, the origin of the information was not revealed by the hacker, who simply said they accessed it through a cybersecurity vulnerability, and will not reveal the origin of the leak until the website’s security access improves.
It is not known if this is an official government website or another source.
One possible official source for the leak is the Système d'immatriculation des véhicules (SIV), France’s official vehicle registration system.
It is worth noting, however, that no confirmation of a leak has been made by either a government or official source.
FrenchBreaches has also reported on another post by a hacker using the pseudonym ‘Vagrantly’, who claims to have found a breach in an unnamed driving website.
Unlike other cybersecurity attacks, which see databases downloaded during a brief period of unauthorised access and then put up for sale online, the hacker is instead reportedly selling information on how to directly hack the site itself.
If this is true, up to 50 million unique pieces of information (number plates, emails, addresses, phone numbers, etc) are vulnerable.
Drivers should remain vigilant
Calls for increased vigilance against scammers are now commonplace in France following a spate of recent data breaches, including of several government databases.
These most recent reports however focus specifically on drivers, and the information being taken (including vehicle number plates) could be used by scammers to pose as driving authorities.
This could include fraudsters posing as fine agency ANTAI (Agence nationale de traitement automatisé des infractions).
A common current scam sees a fraudulent text or email allegedly from ANTAI, informing a driver of a fine they received and a link to an official-looking but fake website to pay the fine.
The addition of a driver’s licence plate in this email or text can make it seem more legitimate.
Tell-tale signs of a fake website include its URL, which will not match official government websites (these usually end in .gouv.fr).
In addition, ANTAI does not text fines to drivers, but typically sends fines in the post.
Drivers who enter bank details on this fake website could see large amounts of money debited by scammers, or even have it used as part of a more sophisticated scam, for example posing as an employee of their local bank.
If you receive a text or email about a fine, do not pay it instantly using the link but rather check the fine’s legitimacy on the ANTAI website.
You can use the reference number of the fine given on the text or email to see if it is legitimate, and then pay the fine directly through the official website (found at amendes.gouv.fr).
Information on how to do this is available in our article here.
