Strasbourg transit operator CTS confirms theft of data from 230,000 customer accounts

On Wednesday, October 28, the Compagnie des transports strasbourgeois (CTS), which operates the trams and buses in Strasbourg, announced that customer data had been copied from its website. The affected customers have been notified. According to a statement seen by ICI Alsace and picked up by franceinfo, about 230,000 customer accounts are affected.

According to reports of that statement, the stolen data includes names, dates of birth, postal addresses and account IDs. CTS says passwords and bank details were not affected. The specialist site cyberattaque.org puts the share of affected accounts at about 40% of the total. France 3 Grand Est gives the same order of magnitude: CTS has nearly 586,000 customer accounts, and the leak affects almost 4 in 10 of them.

How did the data get out?

CTS describes an exfiltration, meaning a copy of the data to an outside location, made possible by illicit use of its website. “As soon as the incident was identified, the exfiltration was stopped and security around the site was stepped up,” the company said, as quoted by franceinfo. It reported the incident to the CNIL (the French data protection authority) and, according to ICI Alsace, a complaint is to be filed with the Strasbourg court.

Several questions remain open. CTS has not named anyone responsible. Its chief executive, Emmanuel Auneau, did say, according to Clubic, that the attack took place overnight from Sunday, October 18, to Monday, October 19. No claim of responsibility or sale of the data has been spotted so far. Finally, an account does not necessarily match one person: the exact number of travelers affected is not known.

This is not the first warning for the operator. In November 2024, about a hundred accounts were hit by fraudulent logins using credentials stolen from other sites. No link between the two cases has been established.

Why this data is still dangerous

Without a password or card number, the leak may look harmless. It is not quite. A name, an address and a date of birth are enough to write a very convincing message in CTS's name: a fake subscription renewal, a refund to claim, a rejected direct debit. This is the risk already pointed out after other file thefts, such as at the French Sailing Federation.

Best practices for CTS customers

• Be wary of any message (email, text, call) in CTS's name that asks for bank details or a payment. The company itself urges vigilance on this point.
• Do not click links in a suspicious message. Use the official CTS website or app to check your account.
• If you use the same password on other sites, change it as a precaution, even though CTS says it was not affected. Turn on two-factor authentication wherever it is available.
• A message that knows your date of birth is not proof of authenticity: that is precisely the data that leaked.

It remains to be seen who emptied this file, and whether the data will resurface on a resale forum. According to Clubic, CTS does not yet know whether it has been resold or published.