Massive Data Leak Exposes 45 Million French Records in Suspected Criminal Compilation A misconfigured cloud database hosted in France exposed over 45 million records belonging to French citizens, likely compiled by malicious actors from multiple breached sources. The unprotected repository, discovered by Cybernews researchers, contained a mix of sensitive datasets, including: - 9.2 million healthcare professional records, mirroring France’s official RPPS/ADELI registries. - 23 million voter or demographic entries, featuring full names, addresses, and birthdates. - 6 million financial profiles, some with IBANs and BICs tied to French banks. - Automotive insurance and vehicle registration data, linking individuals to their cars. - Customer relationship management (CRM) records, including contact details from business systems. Unlike typical corporate breaches, this incident appears to be the work of data brokers or cybercriminals who aggregated stolen information from unrelated sources to enhance its resale value. The dataset’s structure suggests it was designed for identity cross-linking, enabling targeted phishing, financial fraud, and synthetic identity creation. The exposed server was secured after researchers notified the hosting provider, but the duration of the leak remains unknown. The breach poses severe risks, including large-scale social engineering attacks and persistent infiltration of critical systems. This incident follows a surge in cyberattacks targeting French institutions, including recent breaches at Eurofiber France (where attackers accessed a ticket management platform) and high-profile compromises at the French Ministry of the Interior, the University of Lille, and Grenoble École de Management. The scale and diversity of the leaked data underscore the growing threat of criminal data aggregation in cybercrime operations.