SGS data breach: 22.7 million people claimed in French vehicle inspection leak

The SGS data breach is a hacking claim against the French subsidiary of the Swiss group, which runs the vehicle inspection networks Sécuritest, Auto Sécurité and Vérif’Autos. A database presented as coming from SGS was put up for sale on a cybercrime forum on November 8, 2026, according to Fuites Infos. SGS has not confirmed the intrusion and the volumes claimed have not been verified.

If the figures are accurate, the file would link names, addresses and phone numbers to license plates and a vehicle inspection history. Here is what is claimed, where sources differ and what you can do right now.

What do we know about the SGS data breach?

We know a sale offer exists, a sample has circulated and SGS confirms nothing for now. Fuites Infos says the group runs three vehicle inspection networks in France, Auto Sécurité, Sécuritest and Vérif’Autos, and that the claim targets SGS as a whole. Sécuritest is therefore only one of the brands affected. The site classifies the incident as “claimed” and notes that the most recent records in the sample date from October 30, 2026.

Fuites Infos analyzed the freely released sample. According to the site, it contains customer records linking names, addresses and phone numbers to plates, but also center invoices, a staff directory, access data and bank details.

SGS data breach: which data is claimed?

According to Fuites Infos, the database would contain customers’ identity and contact details (name, postal address, phone, email, sometimes date of birth), plates, vehicle serial numbers, mileage and inspection history. It would add center invoices, amounts and payments, the staff directory and access data for center tools: usernames, plaintext or hashed passwords, tokens and IP addresses. The site also cites the IBAN and BIC of the centers’ payment accounts.

Tinynews, which relayed the FrenchBreaches alert, describes a narrower scope: names, addresses, phone numbers, emails, plates, makes and models, mileage and inspection results, sometimes covering more than seven years. That is not necessarily a contradiction, but only Fuites Infos mentions center access data and bank details.

Figures that vary between sources

The volumes do not match exactly. Tinynews reports about 96 GB, 22.68 million people, 40.9 million unique plates and 74.7 million inspection records. Fuites Infos puts forward about 259 million lines, nearly 4,000 centers, 90.8 million vehicles, 74.7 million inspections and 22.7 million people, noting that the number of people actually affected has not been established. Both texts agree on 96 GB, 22.7 million people and 74.7 million inspections.

• Announcement date: November 7 for FrenchBreaches (per Tinynews), November 8 for Fuites Infos.
• Seller: Tinynews cites an actor named ChimeraZ, Fuites Infos does not name the seller.
• Vehicles: 40.9 million unique plates on one side, 90.8 million vehicles on the other, with no explanation for the gap.
• Number of victims: an owner can have several vehicles and a vehicle several inspections, so 22.7 million people cannot be derived from the other figures.

Another episode after other plate leaks

This claim is part of a series of announcements about license plates, which should not be added together. According to Génération NT, an actor named ChimeraZ offered a file of 905,097 lines and 847,064 unique plates on October 24, tied to names, addresses, emails and phone numbers, and he reportedly already targeted political parties, gun shops and the French shooting federation. We covered that last case in our article on the French Shooting Federation breach.

Separately, L’argus reported the claim against Auto-Planning, a vendor of appointment-booking tools for vehicle inspection centers: 13.9 million plates and about 18 million people, with a ransom demand of $33,333, a scope still unconfirmed. The sources we consulted do not link Auto-Planning to SGS, and we do not make that link either. They also differ on the date: October 24 for the announcement according to L’argus, October 29 for the report according to Tinynews.

What are the risks for vehicle owners?

The main risk is targeted phishing: a message citing your plate, your model or the date of your last inspection looks legitimate. Génération NT gives examples of fake fine texts and of fake garages or insurers that know your vehicle. Our guide to phishing details the signs that should alert you.

For inspection centers, the risk is different. If the credentials and bank details cited by Fuites Infos are authentic, they enable account takeovers and fake transfer requests, backed by real invoices. These points remain to be confirmed.

Our analysis: caution on numbers, vigilance on messages

This section is our analysis. A claim on a forum is not proof, and the gaps between sources show that no figure is solid at this stage. On the other hand, the sample analyzed by Fuites Infos contains very recent records (October 30), which makes an old extraction unlikely. We are waiting for a response from SGS and, if applicable, a filing with the French data protection authority (CNIL) before calling it a confirmed breach.

What to do after the SGS data breach

You cannot know whether your data is in the file, so act as if it might be. Fuites Infos recommends the following steps:

1. Do not reply to any message claiming to come from SGS, an inspection center or a fines service without going through the official site. Never share an SMS code, a password or bank details.
2. Check your bank statements and dispute any unauthorized debit: the window is 13 months, according to Fuites Infos.
3. Change the password of your SGS account and of any service where you used it, and enable two-factor authentication where available.
4. Check any fine on the official ANTAI site and report scam attempts to cybermalveillance.gouv.fr.
5. In case of identity theft or a cloned plate, file a police report and keep the receipt.

Frequently asked questions about the SGS data breach