Hackers claim to have stolen MOT-style inspection appointments booked through Auto-Planning

On October 29, the Auto-Planning website displayed a maintenance message. Earlier, according to the FrenchBreaches monitoring site, hackers had replaced the home pages of auto-planning.fr and auto-controle-paris.com with a message claiming the theft of its data.

Based in Boulogne-Billancourt, Auto-Planning has published online appointment-booking software since 2007 for garages, driving schools and, above all, vehicle inspection centers (the French contrôle technique, a mandatory periodic roadworthiness check). The company says it works with more than 450 centers, including affiliates of the sector's major networks. Nothing indicates that those networks' own systems were affected.

What do the hackers say they hold?

The attackers claim to hold data on up to 18 million people and about 14 million license plates. FrenchBreaches, which says it received statistics and samples, mentions more than 200 million rows and about 92 million appointments, some dating back to 2008.

The samples reportedly show names, email addresses, mobile numbers, vehicle makes and models, plates, appointment details, centers visited and IP addresses. The hackers also say they took invoices, source code and access credentials. They demand $33,333 within 72 hours, or they threaten to publish everything.

These figures should be treated with caution. A row count is not a headcount, and the 18 million figure is an estimate after deduplication, not an official count. FrenchBreaches itself stresses that the samples do not prove that the entire announced volume was stolen. The Cyberattaque.org monitoring site, for its part, notes that the exact categories of compromised data could not be independently verified. As of October 29, Auto-Planning had published no statement.

What to do if you booked an appointment online

Even if partial, such a database is valuable to scammers: it links a person, a phone number and a vehicle. That is enough to write a very convincing text message about a “re-inspection reminder” or a “late penalty.”

• Be wary of texts or emails that cite your plate or your last inspection and ask for payment: an inspection center does not demand fines by message.
• If in doubt, call the center directly, using a number you looked up yourself.
• If you created an account with a password reused elsewhere, change it on your other services.

The earlier case of the I-CAD pet registry showed that a massive claim can turn out to be partly exaggerated, or on the contrary very real. The answer will come from Auto-Planning, or from the expiry of the ultimatum.