Unverified claim — August 24, 2026: Actor Lagui1337 is selling about 1,899,454 French loyalty-platform profiles from YouFid for €1,000, with samples showing names, emails, phones, DOB, card/QR IDs, and first-store context. Coverage: Cyberattaque.org. Catalog: youfid-lagui13372026.
Quick, O’Tacos, and McDonald’s appear as loyalty context in reporting — that is platform data, not a confirmed restaurant SIS breach.
What samples show
Cyberattaque.org reviewed lines with personal coordinates plus loyalty metadata dating to 2015. Actor rates: ~99% email, ~49% phone, ~33% name, ~23% DOB.
Action items
- Assume loyalty emails may fuel “your Quick/O’Tacos points expire” phishing.
- Change reused passwords on food-app accounts.
- Merchants on YouFid: ask the vendor for an incident status in writing.
- Ignore Telegram “YouFid dump check” bots.
Canonical
youfid-lagui13372026 — 1899454 actor rows; companyConfirmed false.
Phishing after a named SaaS or loyalty breach usually arrives before any polished FAQ. Attackers need a headline and a few accurate fields, not your regulator’s timeline.
Reuse of passwords across support portals, loyalty apps, and email remains the fastest path from an email dump to account takeover. Unique passwords plus MFA beat regret.
Journalists should separate confirmed company sentences from actor table counts in every headline. Collapsing them produces false precision.
Secondary scams include fake “leak lookup” bots, fake CNIL complaint portals, and monitoring signups that harvest more data than they protect.
If you forward breach news in work Slack, forward the official domain and the BreachHistory canonical link — not a forum sales screenshot.
Support agents and cashiers become social-engineering targets when conversation or loyalty context leaks. Brief them early.
Data minimization still wins. Storing API secrets beside customer chat archives is a gift to whoever lands the foothold.
International customers of French SaaS tools should not assume “France only.” Personalized lures travel with the email address.
Call-center staff should use out-of-band verification when a caller recites recent ticket trivia. Accuracy is not authentication.
Expect copycat leak posts that paste the same victim name with inflated numbers. Check dates and primary URLs.
Legal teams drafting notices should wait for inventory rather than marketing every actor CSV as gospel.
Open bookmarks to official portals now so you are not searching under panic later.
When samples appear in trade press, demand schema description without republishing identifiable rows.
Partners reading this as a peer incident should tabletop: Sunday discovery, same-day holding statement, and customer SMS without payment links.
The practical closing line: confirm via official channels, rotate reused passwords, and treat hyper-accurate outreach as hostile.
BreachHistory updates rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture.
Merchants whose customers appear in a loyalty or support-platform dump still own the customer relationship — and the phishing blowback.
Rotate API keys and webhook secrets whenever a vendor chat or analytics stack is named in a leak claim, even before confirmation.
Phishing after a named SaaS or loyalty breach usually arrives before any polished FAQ. Attackers need a headline and a few accurate fields, not your regulator’s timeline.
Reuse of passwords across support portals, loyalty apps, and email remains the fastest path from an email dump to account takeover. Unique passwords plus MFA beat regret.
Journalists should separate confirmed company sentences from actor table counts in every headline. Collapsing them produces false precision.
Secondary scams include fake “leak lookup” bots, fake CNIL complaint portals, and monitoring signups that harvest more data than they protect.
If you forward breach news in work Slack, forward the official domain and the BreachHistory canonical link — not a forum sales screenshot.
Support agents and cashiers become social-engineering targets when conversation or loyalty context leaks. Brief them early.
Data minimization still wins. Storing API secrets beside customer chat archives is a gift to whoever lands the foothold.
International customers of French SaaS tools should not assume “France only.” Personalized lures travel with the email address.
Call-center staff should use out-of-band verification when a caller recites recent ticket trivia. Accuracy is not authentication.
Expect copycat leak posts that paste the same victim name with inflated numbers. Check dates and primary URLs.
Legal teams drafting notices should wait for inventory rather than marketing every actor CSV as gospel.
Open bookmarks to official portals now so you are not searching under panic later.
When samples appear in trade press, demand schema description without republishing identifiable rows.
Partners reading this as a peer incident should tabletop: Sunday discovery, same-day holding statement, and customer SMS without payment links.
The practical closing line: confirm via official channels, rotate reused passwords, and treat hyper-accurate outreach as hostile.
BreachHistory updates rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture.
Merchants whose customers appear in a loyalty or support-platform dump still own the customer relationship — and the phishing blowback.
Rotate API keys and webhook secrets whenever a vendor chat or analytics stack is named in a leak claim, even before confirmation.
Phishing after a named SaaS or loyalty breach usually arrives before any polished FAQ. Attackers need a headline and a few accurate fields, not your regulator’s timeline.
Reuse of passwords across support portals, loyalty apps, and email remains the fastest path from an email dump to account takeover. Unique passwords plus MFA beat regret.
Journalists should separate confirmed company sentences from actor table counts in every headline. Collapsing them produces false precision.
Secondary scams include fake “leak lookup” bots, fake CNIL complaint portals, and monitoring signups that harvest more data than they protect.
If you forward breach news in work Slack, forward the official domain and the BreachHistory canonical link — not a forum sales screenshot.
Support agents and cashiers become social-engineering targets when conversation or loyalty context leaks. Brief them early.
Data minimization still wins. Storing API secrets beside customer chat archives is a gift to whoever lands the foothold.
International customers of French SaaS tools should not assume “France only.” Personalized lures travel with the email address.
Call-center staff should use out-of-band verification when a caller recites recent ticket trivia. Accuracy is not authentication.
Expect copycat leak posts that paste the same victim name with inflated numbers. Check dates and primary URLs.
Legal teams drafting notices should wait for inventory rather than marketing every actor CSV as gospel.
Open bookmarks to official portals now so you are not searching under panic later.
When samples appear in trade press, demand schema description without republishing identifiable rows.
Partners reading this as a peer incident should tabletop: Sunday discovery, same-day holding statement, and customer SMS without payment links.
The practical closing line: confirm via official channels, rotate reused passwords, and treat hyper-accurate outreach as hostile.
BreachHistory updates rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture.
Merchants whose customers appear in a loyalty or support-platform dump still own the customer relationship — and the phishing blowback.
Rotate API keys and webhook secrets whenever a vendor chat or analytics stack is named in a leak claim, even before confirmation.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.
BreachHistory will revise this page when primary sources publish a tighter census, field list, or confirmation status. Until then, treat actor marketing numbers as labeled claims and company notices as the floor of what is confirmed.