Actor claims leak of 45,059 Valeurs Actuelles subscriber records
A threat actor on an underground forum claims a JSON dump dated October 20, 2026, taken from the online shop of French magazine Valeurs Actuelles, holds data of about 45,059 subscribers, including names, addresses, emails, and SHA-256 password hashes. The claim, reported by DailyDarkWeb on October 27, is unverified, and the magazine has not confirmed an incident. Subscribers should change reused passwords and be wary of renewal or invoice emails quoting real personal data.
What happened
On October 27, 2026, a threat actor on an underground forum shared a JSON database, dated October 20, allegedly extracted from the online shop of French magazine Valeurs Actuelles. The actor claims the file holds data of about 45,059 subscribers, including full names, postal addresses, emails, and hashed passwords. The claim is unverified and Valeurs Actuelles has not confirmed an incident.
Why it matters
If the data is real, subscribers face convincing phishing, with fake renewal, invoice, or account-security emails quoting real names, addresses, and subscriptions. DailyDarkWeb also flags doxxing and harassment risk, as the post is politically motivated. Reused passwords are at risk because unsalted SHA-256 hashes crack quickly.
What to do
Monitor official Valeurs Actuelles channels for confirmation or denial. Advise subscribers to change reused passwords and treat emails quoting real subscription data with caution. Reinforce training against personalized phishing.
For the technical team
- Affected
- Valeurs Actuelles Loja online (boutique) da revista semanal francesa Valeurs Actuelles; dados de cerca de 45.059 assinantes, segundo alega · Online shop (boutique) platform of the French conservative weekly Valeurs Actuelles, per the claim. No specific software product or version cited. Claimed scope: about 45,059 subscriber records.
- Exploitation
- No vulnerability exploitation reported. Leak claim posted on an underground forum on October 27, 2026 and reported by DailyDarkWeb. Dump dated October 20, 2026. Claim not independently verified; Valeurs Actuelles has not confirmed an incident.
- Fix
- No fix cited in the sources; no software vulnerability is associated with the case.
- Vector
- Not described in the sources; how the dump was obtained is not stated.
- More details
- The actor claims the dump includes full names, postal addresses (city, zip code, country), emails, AboWeb customer IDs, subscription types, SHA-256 password hashes, and a 'factures' table with 48,547 invoice rows. Per DailyDarkWeb, the post is openly political (anti-far-right), raising doxxing or harassment risk for subscribers. Unsalted SHA-256 hashes crack quickly, exposing reused passwords. DailyDarkWeb classifies the case as an unverified threat-actor claim, with no confirmed breach.
Timeline
Underground forum post claims leak of Valeurs Actuelles shop subscriber data.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
