Unverified claim — August 24, 2026: Actor 0xSec claims more than 140GB across four databases from French customer-support AI vendor Klark.ai, estimating roughly 500,000 people in support chats and accounts. Canonical: klark-ai-0xsec2026. Coverage: Cyberattaque.org.
This is a vendor-platform story. Showroomprivé, BUT, Back Market, Vestiaire Collective, Click & Boat and others appear as conversation volume — not proof their own networks were breached.
What 0xSec claims
Four bases, 162 CSV files, some with millions of rows; names, emails, phones, password hashes, support conversations, technical logs, API keys/secrets, and some IBANs. The actor says extraction was stopped early.
Who would be at risk if real
Support agents on Klark.ai and customers who chatted with those brands through the tool. API secrets could widen follow-on compromise if still valid.
Action items
- Brands using Klark.ai: rotate API keys and review chat retention.
- Customers: treat “your recent ticket” SMS citing exact order trivia as hostile.
- Do not download alleged 140GB dumps.
- Wait for a Klark.ai or brand notice before treating 500k as census.
Canonical
klark-ai-0xsec2026 — recordsAffected 500000 actor estimate; companyConfirmed false.
Phishing after a named SaaS or loyalty breach usually arrives before any polished FAQ. Attackers need a headline and a few accurate fields, not your regulator’s timeline.
Reuse of passwords across support portals, loyalty apps, and email remains the fastest path from an email dump to account takeover. Unique passwords plus MFA beat regret.
Journalists should separate confirmed company sentences from actor table counts in every headline. Collapsing them produces false precision.
Secondary scams include fake “leak lookup” bots, fake CNIL complaint portals, and monitoring signups that harvest more data than they protect.
If you forward breach news in work Slack, forward the official domain and the BreachHistory canonical link — not a forum sales screenshot.
Support agents and cashiers become social-engineering targets when conversation or loyalty context leaks. Brief them early.
Data minimization still wins. Storing API secrets beside customer chat archives is a gift to whoever lands the foothold.
International customers of French SaaS tools should not assume “France only.” Personalized lures travel with the email address.
Call-center staff should use out-of-band verification when a caller recites recent ticket trivia. Accuracy is not authentication.
Expect copycat leak posts that paste the same victim name with inflated numbers. Check dates and primary URLs.
Legal teams drafting notices should wait for inventory rather than marketing every actor CSV as gospel.
Open bookmarks to official portals now so you are not searching under panic later.
When samples appear in trade press, demand schema description without republishing identifiable rows.
Partners reading this as a peer incident should tabletop: Sunday discovery, same-day holding statement, and customer SMS without payment links.
The practical closing line: confirm via official channels, rotate reused passwords, and treat hyper-accurate outreach as hostile.
BreachHistory updates rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture.
Merchants whose customers appear in a loyalty or support-platform dump still own the customer relationship — and the phishing blowback.
Rotate API keys and webhook secrets whenever a vendor chat or analytics stack is named in a leak claim, even before confirmation.
Phishing after a named SaaS or loyalty breach usually arrives before any polished FAQ. Attackers need a headline and a few accurate fields, not your regulator’s timeline.
Reuse of passwords across support portals, loyalty apps, and email remains the fastest path from an email dump to account takeover. Unique passwords plus MFA beat regret.
Journalists should separate confirmed company sentences from actor table counts in every headline. Collapsing them produces false precision.
Secondary scams include fake “leak lookup” bots, fake CNIL complaint portals, and monitoring signups that harvest more data than they protect.
If you forward breach news in work Slack, forward the official domain and the BreachHistory canonical link — not a forum sales screenshot.
Support agents and cashiers become social-engineering targets when conversation or loyalty context leaks. Brief them early.
Data minimization still wins. Storing API secrets beside customer chat archives is a gift to whoever lands the foothold.
International customers of French SaaS tools should not assume “France only.” Personalized lures travel with the email address.
Call-center staff should use out-of-band verification when a caller recites recent ticket trivia. Accuracy is not authentication.
Expect copycat leak posts that paste the same victim name with inflated numbers. Check dates and primary URLs.
Legal teams drafting notices should wait for inventory rather than marketing every actor CSV as gospel.
Open bookmarks to official portals now so you are not searching under panic later.
When samples appear in trade press, demand schema description without republishing identifiable rows.
Partners reading this as a peer incident should tabletop: Sunday discovery, same-day holding statement, and customer SMS without payment links.
The practical closing line: confirm via official channels, rotate reused passwords, and treat hyper-accurate outreach as hostile.
BreachHistory updates rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture.
Merchants whose customers appear in a loyalty or support-platform dump still own the customer relationship — and the phishing blowback.
Rotate API keys and webhook secrets whenever a vendor chat or analytics stack is named in a leak claim, even before confirmation.
Phishing after a named SaaS or loyalty breach usually arrives before any polished FAQ. Attackers need a headline and a few accurate fields, not your regulator’s timeline.
Reuse of passwords across support portals, loyalty apps, and email remains the fastest path from an email dump to account takeover. Unique passwords plus MFA beat regret.
Journalists should separate confirmed company sentences from actor table counts in every headline. Collapsing them produces false precision.
Secondary scams include fake “leak lookup” bots, fake CNIL complaint portals, and monitoring signups that harvest more data than they protect.
If you forward breach news in work Slack, forward the official domain and the BreachHistory canonical link — not a forum sales screenshot.
Support agents and cashiers become social-engineering targets when conversation or loyalty context leaks. Brief them early.
Data minimization still wins. Storing API secrets beside customer chat archives is a gift to whoever lands the foothold.
International customers of French SaaS tools should not assume “France only.” Personalized lures travel with the email address.
Call-center staff should use out-of-band verification when a caller recites recent ticket trivia. Accuracy is not authentication.
Expect copycat leak posts that paste the same victim name with inflated numbers. Check dates and primary URLs.
Legal teams drafting notices should wait for inventory rather than marketing every actor CSV as gospel.
Open bookmarks to official portals now so you are not searching under panic later.
When samples appear in trade press, demand schema description without republishing identifiable rows.
Partners reading this as a peer incident should tabletop: Sunday discovery, same-day holding statement, and customer SMS without payment links.
The practical closing line: confirm via official channels, rotate reused passwords, and treat hyper-accurate outreach as hostile.
BreachHistory updates rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture.
Merchants whose customers appear in a loyalty or support-platform dump still own the customer relationship — and the phishing blowback.
Rotate API keys and webhook secrets whenever a vendor chat or analytics stack is named in a leak claim, even before confirmation.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.