Location Etudiant: Actor offers alleged…

MediumBreachNo software to update

In 30 seconds

Alleged

A threat actor using the name “Bonjour” is allegedly offering 825,894 records attributed to French student-housing platform Location Étudiant. The latest report says samples were published and offers are being accepted, but it explicitly describes the claim as unverified.

What happened

Alleged

Two threat-intelligence accounts reported seeing a sale claim for a database attributed to Location Étudiant. The advertised material allegedly includes identity and contact information alongside details of rental inquiries and communications with landlords.

Why it matters

Inferred

If authentic, the combination could make scams more convincing because a message could refer to a real housing search, property reference or previous landlord contact. Students and renters could then face targeted phishing, fake-deposit requests or impersonation attempts rather than only generic spam.

What to do

Inferred

Location Étudiant users should treat unexpected rental messages with caution, verify landlords and listings through a separate channel, and avoid sending deposits or documents from links received by email or text. Reused passwords should also be changed, although the advertised field lists do not mention passwords.

Confirmed and still uncertain

Contested

What is observed is that two accounts documented a sale claim and described its advertised contents. The evidence does not independently establish that Location Étudiant was breached, that the samples are genuine, that 825,894 represents unique people, how the information was obtained, or whether anyone purchased it.

What people are saying

Observed

DarkWebInformer called the claim unverified and reported that the seller had published samples. DailyDarkWeb likewise warned that this was a threat-actor claim rather than confirmation of a breach, adding that it had seen no official statement at the time of its post.

Evolution

Observed

DailyDarkWeb first described an offer of roughly 825,000 rows and emphasized the lack of confirmation. A later DarkWebInformer post supplied the more precise figure of 825,894 records and said the actor was accepting offers for the complete database, without adding independent verification.

Reach

Observed

2 independent groups, 2 updates, and 4 engagements.

Technical detail

Alleged

The advertised fields reportedly include names, email addresses, telephone numbers, postal or residential addresses, IP addresses, rental messages, property or residence identifiers, contact dates, contact histories and marketing-consent fields. Neither report provides technical evidence explaining the alleged access method.

Sources and evidence

Observed

The available evidence consists of two social-media reports with attached images describing the same marketplace claim. Both preserve important caveats, but the batch contains no statement from Location Étudiant, independently authenticated sample, forensic report or regulator notice that would confirm the alleged compromise.