Hacker claims to be selling data of 22.7 million customers of Sécuritest and Auto Sécurité vehicle inspection centers

Your license plate, your mileage, the date of your last vehicle inspection. A seller claims to hold this information on 22.7 million people. The database has been for sale since November 8 on a cybercriminal forum.

The seller presents it as the French portion of SGS's databases: 96 gigabytes, about 259 million rows. The Swiss group describes itself as the number one vehicle inspection operator in France, with nearly 2,000 centers under the Sécuritest and Auto Sécurité brands. The listing also mentions Vérif'Autos. According to the site Cyberattaque.org, the seller goes by ChimeraZ and claims 22,688,152 people. To our knowledge, SGS and its brands had neither confirmed nor denied the intrusion as of the morning of November 12. The figures cited therefore come from the hacker.

Plates, mileage and inspection history

According to the listing and the samples examined by the sites Fuites Infos and Cyberattaque.org, the dataset reportedly mixes several types of data.

• Customers: name, address, phone number, email, license plate, vehicle serial number, mileage, inspection history and, for some of them, date of birth.
• Centers: invoices, amounts, bank details (IBAN and BIC) and access to their tools. In the sample reviewed by Fuites Infos, some passwords were readable in plain text.
• Group: a staff directory.

The samples do not prove the claimed scale, but they are recent. The most recent entries seen by Fuites Infos date from October 30, 2026. Those in the billing sample examined by Cyberattaque.org range from September 2008 to October 2026, which is not enough to date the intrusion, the site points out.

Why 259 million rows do not mean 259 million victims

A single driver can appear in many rows: their record, their vehicle's record, their inspections, their invoices. The seller themself claims 90.8 million vehicle records and 74.7 million inspections. Its contact figures are much more modest than the number of people claimed: 9.6 million phone numbers and 4.1 million unique email addresses, according to the breakdown reported by Cyberattaque.org. Out of 40.9 million plates, about 13 million are said to be linked to personal data. Cyberattaque.org examined 36 files, or 42,570 rows. It could verify neither the total size nor the number of distinct individuals.

The sector is repeatedly targeted. At the end of October, another claim concerned Auto-Planning, an online appointment-booking service used by hundreds of vehicle inspection centers: 13.9 million plates according to L'argus, which attributes it to the same alias, ChimeraZ. No link with SGS has been established.

Best practices while waiting for SGS

Even unconfirmed, such a database is enough to make fraudulent messages credible: a scammer who knows your plate and your last inspection inspires trust. Here is the advice published by Safecode and Fuites Infos.

• Do not respond to any text message, email or call claiming to come from a center, SGS or a fines service: go through the official website yourself. Never share a code received by text message, a password or your bank details.
• Check a fine only on the ANTAI website (France's national traffic fines agency) and report scam attempts on cybermalveillance.gouv.fr.
• If you have an online account with any of the brands, change its password, as well as the password of any service where you reuse it.

Center operators are also affected: their access credentials and bank details are said to be in the dataset. It is prudent to change the passwords for their tools right away and to be wary of any request to change bank details.

SGS's response is still pending. If the intrusion is confirmed, the group will have to notify the CNIL (the French data protection authority) and inform the individuals concerned if the risk to them is high.