A cybercriminal is offering for sale files presented as coming from the SGS group’s vehicle inspection networks, Sécuritest, Auto Sécurité and Vérif’Autos: he claims 22.7 million people and nearly 41 million number plates. No confirmation from SGS had been noted at the time of the first reports, and the volumes have not been verified. But the samples examined by two specialist outlets are consistent with an automotive services business, which warrants vigilance from drivers and inspection centres.
A sales listing on a criminal forum
The claim dates from 7 November 2026, according to FrenchBreaches, which spotted it and says it alerted SGS several days before publishing its alert on 8 November. The seller, who goes by ChimeraZ, is offering around 96 GB of files, or some 259 million rows covering more than seven years of activity. Initially attributed to Sécuritest, the files are presented in the listing as coming from SGS’s three vehicle inspection brands in France: Sécuritest, Auto Sécurité and Vérif’Autos.
The same pseudonym is not unknown. Zataz attributes to it claims targeting French tourism in May 2026 and then several political parties in October. At the end of September, Solutions Numériques also relayed a listing signed ChimeraZ covering 8.6 million patients of the medical scheduling platform Alaxione, whose volumes were not confirmed either.
Impressive volumes, to be read with caution
The figures put forward by the seller are considerable: 3,988 centres listed, 90.8 million vehicle records, 74.7 million inspections, 22,688,152 people, 40.9 million distinct plates of which around 13 million are linked to personal data, more than 9.5 million phone numbers and just over 4 million email addresses. Zataz stresses one point: rows, people and plates overlap and must not be added together. The same motorist may appear in several files, and the total number of people is not a confirmed unique count.
The data described combine identity, contact details, postal address, plate, vehicle identification number, make, model, mileage, inspection dates and results, as well as information about the centres and inspectors. Cyberattaque.org examined 36 sample files, or 42,570 rows. Its findings confirm a structure typical of an automotive services network, but do not make it possible to identify the exact source of the export, to attribute the records to a specific brand, or to date the intrusion. The dates in the files run up to the end of October 2026, which says nothing about when they may have been extracted.
The most sensitive point concerns the centres
For professionals, a detail noted by Cyberattaque.org deserves attention: a file devoted to the inspection centres reportedly contains, in plain text, passwords, connection settings and banking details. The outlet specifies that it did not test any access and did not publish any secrets. If these elements are authentic and still valid, the risk is no longer limited to phishing aimed at customers: it affects the very tools used by centre operators. Changing the passwords of business accounts, checking recent access and asking the network head office about its findings are the first common-sense measures.
In their publications of 8 and 9 November, FrenchBreaches and Cyberattaque.org reported neither confirmation nor denial from SGS; Zataz does not mention any reaction from the group. The authenticity of the files, their origin, any compromise of the group’s systems and the existence of a buyer remain unknown. No fraudulent use has been established.
Motorists: the scams to anticipate
Combining a name, a phone number and a plate with a vehicle’s inspection history makes it possible to craft very convincing messages. FrenchBreaches cites several possible scenarios if the data are real: fake inspection reminders, fake fines, scams related to vehicle registration certificates or identity theft. A few rules limit the risk:
- be wary of any unsolicited text message or email that mentions your plate, your vehicle or an inspection to be redone;
- only pay a fine on the official government website, never via a link received by message;
- contact your usual centre directly, using a known number, if in doubt about a reminder;
- do not reuse the same password across several services.
The case illustrates an underlying trend: the files of everyday services, seemingly not very sensitive, become raw material for fraudsters as soon as they link people to assets and to specific dates.
Frequently asked questions
Has the Sécuritest leak been confirmed?
No. It is a claim published on a cybercriminal forum. No public statement from SGS had been noted by specialist outlets at the time of their publications on 8 and 9 November, and the volumes announced come from the seller.
Which brands are named?
Sécuritest, Auto Sécurité and Vérif’Autos, three vehicle inspection brands of the SGS group in France. The samples do not make it possible to know whether all three networks are actually affected.
What are the risks for motorists?
Mainly personalised scam attempts: fake inspection reminders, fake traffic fines or fraudulent procedures involving the vehicle registration certificate. Caution with messages that mention your vehicle remains the best protection.
Sources
- Fuite de données chez Sécuritest, plus de 22 millions de clients potentiellement concernés — FrenchBreaches, 2026-11-08
- SGS : un pirate revendique 259 millions de lignes volées — Zataz, 2026-11-09
- SGS : plus de 22,7 millions de personnes revendiquées dans une fuite de données — Cyberattaque.org, 2026-11-09
- Alaxione : une nouvelle fuite revendiquée porterait sur 8,6 millions de patients — Solutions Numériques, 2026-09-28