Hacker claims theft of 969,000 email addresses from French toy shop Caverne des Jouets

The announcement appeared on November 7 on a cybercriminal forum, seven weeks before Christmas. A seller is offering what they describe as the database of caverne-des-jouets.com, an online toy store based in Attenschwiller, in the Haut-Rhin department of eastern France. The specialist site Fuites Infos, which relayed the claim, details its contents. The company has not publicly confirmed the incident at this stage.

The figures put forward by the seller are high: 969,386 email addresses, 903,115 phone numbers, 895,233 postal addresses and 850,254 passwords, stored as hashes. In all, the data would amount to about 9.4 million rows spread across 73 files, for 4.5 GB, and would cover the period 2009-2026. None of these volumes has been verified.

What the file would contain

According to the list published by Fuites Infos, the records would include:

• customer identity: last name, first name, title and date of birth;
• contact details: email address, phone number and postal address;
• hashed passwords;
• order history, invoices, amounts and loyalty points;
• IP addresses recorded at the time of orders;
• emails exchanged with the store and delivery comments.

Fuites Infos says it analyzed the sample published by the seller. It contains names, email addresses, phone numbers, postal addresses, dates of birth, hashed passwords and order and delivery histories, for customers dating from 2009 to 2022, and some internal accounts show activity in October 2026. The sample contains no banking data.

A claim, not a confirmation

These figures should be read with caution. A number of rows is not a number of victims: the same person may appear in several files, and a database built up since 2009 may contain many old or inactive accounts. The monitoring site FrenchBreaches deems the claim “credible” but classifies it as unconfirmed. The asking price is not known, and the seller is identified only by a pseudonym, ChimeraZ.

The scenario recalls October, when a hacker published 195,000 customer records for free, which they attributed to King Jouet. Toy sellers make a large share of their sales at the end of the year, and their order histories are of interest to scammers.

Did you order from this site? What to do

Even if unconfirmed, the claim warrants a few precautions: real orders and delivery addresses make it possible to write very convincing fake messages.

• If you used this site's password elsewhere, change it on those other services: depending on the hashing method used, a weak password can be recovered.
• Be wary of text messages and emails about deliveries, refunds or loyalty points to redeem, especially if they cite a real order.
• Never give out your banking details in response to an unsolicited message, and check by logging in directly to the site.
• If in doubt, cybermalveillance.gouv.fr (the French government's cybercrime victim assistance service) offers help to victims.

The question remains open: was Caverne des Jouets breached, and since when? Only a response from the company, or a message to its customers, will show whether the announced volumes match reality.