Hacker leaks 195,000 customer records for free, claiming they come from King Jouet

On October 20, a hacker calling themselves Onyxx posted a file on a cybercriminal forum, presented as King Jouet's customer database. They are not selling it: they are giving it away. According to the observatory Cyberattaque.org, which analyzed it, the file contains 195,714 customer records.

King Jouet, a French toy retailer, has not confirmed the leak so far, according to Cyberattaque.org and Fuites Infos, which both relayed the post. No statement from the retailer was visible when the file circulated.

What does the file contain?

According to both sites, each record includes a first and last name, an email address, often a phone number, a postal code, a city and an internal customer ID. There are no passwords, no bank details and no full postal addresses. Cyberattaque.org counts 195,183 distinct email addresses and about 177,000 records with a phone number. Judging by country codes, most customers are in France (133,283 records), ahead of Switzerland, Belgium and Luxembourg.

A file of records is not a list of confirmed victims, and its origin remains to be established. The file's metadata cites a King Jouet subdomain and a management software package, with an extraction dated late on October 20. But Cyberattaque.org points out that this information was written by the file's author: on its own, it does not prove an intrusion. According to Fuites Infos, the hacker claims to have extracted the data the same day, which has not been verified.

The retailer already disputed the scale of a leak in 2025

King Jouet has been through something similar before. In February 2025, a hacker claimed to be selling more than 4 million customer accounts. The retailer acknowledged a cyberattack but disputed its scale: according to the Ostraca registry, it cited fewer than 25,000 affected customers, an attack targeting the online order-tracking interface and limited to two stores, and a report to the CNIL (the French data protection authority). Nothing currently links the two cases.

What to do if you are a customer

Without passwords or payment cards, the file is mainly useful for making fake messages believable: a name, a phone number and the certainty of having bought from a toy seller are enough for a fake "blocked parcel" text or a fake refund. The holiday season makes this easier.

• Be wary of emails, texts or calls claiming to come from King Jouet or a carrier and demanding a payment, even a small one.
• Do not click on the links you receive: go through the official website or app.
• Never share a code received by text, a password or your bank details.
• If in doubt or if you are scammed, the public service cybermalveillance.gouv.fr helps victims free of charge.

French observatories log this kind of post almost every day, as they did recently for the Climb Up climbing gyms, where the leak was eventually confirmed. For King Jouet, the retailer's response will show whether the file really comes from its systems, and whether the CNIL and customers need to be notified.