2026 Journaux.fr — Alduin forum claim; ~270k delivery/billing rows + API flaw alleged (unverified)
Data compromised
Actor: delivery/billing names, addresses, postcodes, cities, company names, order IDs; actor also claims unpatched API lets customers set store credit (unverified); no passwords/cards in sample summary
Technical writeup
Unverified forum claim with operational-security overlay — Dark Web Informer August 27, 2026. Actor Alduin published alleged billing/delivery data for journaux.fr (French newspaper/magazine subscription retailer) as JSONL claiming roughly 270,000 records with paired delivery and billing names, street addresses, postcodes, cities, countries, company names, salutation codes, VAT fields, and order identifiers. DWI noted an arithmetic tension between the claimed volume and a stated 184 KB file size, so the headline count may reflect marketing rather than the unlocked file. The same post allegedly documents an API request that would let authenticated customers set their own account credit balance up to a ceiling — a live fraud risk if accurate. Journaux.fr had not publicly addressed the claim at indexing. recordsAffected 270000 from actor count (unverified; treat cautiously); companyConfirmed false.
Root cause
Unverified forum share by actor Alduin of alleged journaux.fr billing JSONL plus published API credit-manipulation claim (DWI Aug 27, 2026); company had not confirmed