Valeurs actuelles confirms an incident after a hacker leaks subscriber invoices

On October 20, a file appeared on a cybercriminal forum. Its author presents it as the invoices table of the online store of Valeurs actuelles, where the weekly sells subscriptions and special issues. It is offered for download in exchange for the forum's internal credits, along with a slogan hostile to the far right and a comment on the magazine's editorial line, according to the site Fuites Infos.

The next day, October 21, the data protection department of the Valmonde group, the magazine's publisher, told Fuites Infos that the claim corresponded to an incident currently being handled. According to FrenchBreaches, the incident occurred on October 20 at the online store's service provider. The affected passwords have been reset, and the customers concerned are to be informed "soon." The group told Fuites Infos that a notification to the CNIL (the French data protection authority) was being finalized.

How many subscribers are really affected?

No one knows at this stage. The hacker claims about 48,500 billing lines, corresponding to some 45,000 distinct subscribers, since a single subscriber may have several invoices. The magazine has given neither a number nor a list of the exposed data: these figures remain the hacker's.

According to the published excerpts, the file reportedly contains title (Mr./Ms.), name, postal address, email address, customer number, subscription type, invoice references and amounts, as well as a field of password hashes (transformed versions, not plaintext passwords). The age of the data has not been established: the sample shown dates from 2022.

Precautions to take

A password hash is not the password itself, but the simplest ones can sometimes be recovered from it. If you have an account on the Valeurs actuelles store:

• change that password, as well as on any other service where you may have reused it;
• enable two-factor authentication wherever it is offered;
• be wary of emails, letters or calls claiming to come from the magazine that mention your subscription or a payment, since your contact details and invoices make such messages credible;
• if in doubt, the public platform cybermalveillance.gouv.fr offers free assistance.

This scenario recalls other recent claims targeting French retailers, such as the 195,000 records attributed to King Jouet. The message Valmonde has promised its customers will show whether the number of affected subscribers matches the hacker's claim.