What Happened
In November 2025, a threat actor allegedly leaked a database from French travel agency Bourse des Voyages (BDV.fr), exposing approximately 3.3 million customer records in CSV format on a hacker forum. The compromised data included highly sensitive personal information such as full names, email addresses, physical mailing addresses, dates of birth, and phone numbers, likely exfiltrated from vulnerable web servers, outdated CMS platforms, or unsecured databases. This incident, first observed on November 11, 2025, follows a pattern of major French data breaches in 2024-2025 targeting sectors like telecom and healthcare, heightening risks of identity theft, phishing, and fraud for affected users. Independent verification of the leak’s authenticity was ongoing at the time of reporting.
