Caverne des Jouets · Breach

Caverne des Jouets: actor allegedly sells 9.3 million customer records

Nov 07, 2026 · 1 min read

Actor ChimeraZ is advertising 4.5 GB with 9,361,144 records allegedly obtained from Caverne des Jouets, a French online toy retailer; the claim is unverified. The 73-file archive covers 2009 to 2026 and includes emails, phone numbers, addresses, accounts, orders and 850,254 MD5 password hashes. The actor released 1,000 sample records and is accepting offers; customers should change reused passwords.

By HIFY Radar newsroom Updated 11/07/2026 02:24 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

An actor named ChimeraZ is advertising 4.5 GB of customer data allegedly taken from Caverne des Jouets, a French online toy retailer. The package holds 9,361,144 records from 2009 to 2026, including emails, phone numbers, addresses, accounts and order histories. The claim is currently unverified.

Why it matters

If confirmed, it exposes nearly two decades of customer personal data, including 850,254 MD5 password hashes. That feeds email and phone scams, purchase fraud and misuse of delivery details, affecting anyone who bought from the store.

What to do

Change now the password used at the store and anywhere it was reused. Watch for emails and calls that cite old orders. Wait for an official statement from Caverne des Jouets before treating the leak as confirmed.

For the technical team

Affected: Caverne des Jouets, varejista francesa online de brinquedos e jogos; base alegada de 9,3 milhões de registros de cliente · Caverne des Jouets customer database, French online toy retailer; 73 files in 4.5 GB covering records from 2009 to 2026.
Exploitation: Sale advertised by actor ChimeraZ and reported by DarkWebInformer; 1,000 sample records released and offers accepted for the full dataset. Claim currently unverified.
Fix: No fix applicable as this is a data leak; mitigation is changing reused passwords and watching for phishing.
Vector: Obtention method not stated in the sources; the data surfaced in a sale post by actor ChimeraZ on an underground forum.
More details: Alleged package contents: 9,361,144 total entries, 969,386 email addresses, 903,115 phone numbers, 895,233 addresses, 850,254 MD5 password hashes. Also includes customer accounts, order histories, invoices, mailing lists and delivery information.