Portaleco Base de clientes da Portaleco · Breach

Actor alleges leak of 103K Portaleco customer records

Oct 28, 2026 · 1 min read

A threat actor on an underground forum claims to be leaking about 103,000 customer records from Portaleco, a French online seller of motorized aluminum gates, pergolas and fences. The data allegedly includes names, home addresses, postal codes, cities and countries. The claim has not been independently verified and Portaleco has not confirmed an incident.

By HIFY Radar newsroom Updated 10/28/2026 02:29 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A threat actor on an underground forum claims to be leaking data on about 103,000 customers of Portaleco, a French online seller of motorized aluminum gates and pergolas. The material allegedly includes names, home addresses, postal codes, cities and countries. The claim is unverified and the company has not confirmed an incident.

Why it matters

If confirmed, the leak exposes home addresses of buyers of gates and fences. According to DailyDarkWeb, such data could enable targeted scams and physical-security risks for customers. The claim is still unconfirmed, so the risk is potential, not demonstrated.

What to do

Monitor customer service channels for scams using customer names and addresses. Have the technical team review access controls on customer records, with attention to IDOR flaws. Treat it as a claim until Portaleco comments.

For the technical team

Affected: Portaleco Base de clientes da Portaleco, varejista online francesa de portões, pérgolas e cercas de alumínio motorizadas; cerca de · Portaleco customer base, a French online retailer of motorized aluminum gates, pergolas and fences; about 103,000 records allegedly involved.
Exploitation: Leak claim posted on an underground forum and reported by DailyDarkWeb. No independent verification, no company confirmation and no indication of further exploitation.
Fix: No software to update
Vector: According to the actor, the data was pulled through a basic access-control flaw, an IDOR, that let them step through customer records one by one.
More details: Alleged data: names, home addresses, postal codes, cities and countries. DailyDarkWeb assesses that home addresses of buyers of gates and fences could be used for targeted scams or physical-security risks. Full DailyDarkWeb source is subscribers-only.