Hacker claims to sell 1.1 million license plates and customer addresses from MPA

On November 1, 2026, at 2:27 p.m., a hacker using the handle ChimeraZ put 3.1 gigabytes of data up for sale. They attribute it to MPA Group, a printing company based in Marsannay-la-Côte, near Dijon, that sells license plates, stickers and funeral plaques online. The Cyberattaque.org observatory spotted the listing and analyzed an extract.

The seller claims 3,824,749 records, including 1,133,713 distinct plate numbers, more than 1.5 million email addresses, about one million phone numbers and nearly 970,000 password hashes. They say 1,713,120 customers would be affected. The sites named include plaque-immatriculation-auto.com, mpadeco.com, mpa-pro.fr and e-mmat.fr. As of now, MPA has not publicly confirmed the incident.

What does the analyzed extract show?

Cyberattaque.org examined 3,000 rows from three files. Of 1,000 orders, 600 contain at least one plate reference, some of them custom plates. Of 1,000 invoices, 562 link a plate to the recipient's name and address. Almost all the orders (996 out of 1,000) contain a value consistent with a SHA-256 hash, a hash function that, used on its own, is not considered suitable for storing passwords.

The orders span from 2016 to October 19, 2026, so this does not appear to be an old, forgotten database. But a sample does not prove the announced total, and the date of the intrusion remains unknown. Another caveat: the buyer of a plate is not necessarily the holder of the vehicle registration certificate.

Same hacker, third file in less than ten days

This is not ChimeraZ's first attempt. On October 24, they claimed about 847,000 plates, without naming the source site. On October 31, they announced 2.9 million French registrations linked to personal data. Cyberattaque.org advises against adding these figures together, because the files may overlap and their origin has not been established.

Scams to expect

A plate number tied to an address is valuable to a scammer. No fraudulent use of this file has been demonstrated so far, but the risks are well known:

• fake fines sent by text or email quoting your real plate number: Antai (the French national agency for automated offense processing) never asks you to pay through a link received by text, so use the official website;
• cloned plates: a copied plate fitted to another vehicle can get you violation notices for offenses you did not commit; if that happens, file a police report and contest the fine with Antai, without paying it;
• passwords: if you have an account on any of these sites, change the password, and change it everywhere else you may have reused it.

What MPA says, or does not say, about the origin of this data will be the next step to watch.