2026 Pachatours (France) — SQLi leak claim (unverified); 31,087 individuals; passports & payment data alleged
Data compromised
Actor-claimed ~2GB / 2.2M+ rows covering 31,087 unique individuals: plaintext passport numbers, airline PNR codes, B2B agency logins with cleartext passwords, VISA/CB payment transactions, email-system credentials, and accounting entries—unverified
Technical writeup
Unverified actor claim — indexed June 30, 2026. Threat-intelligence reporting documents actors misere, ChimeraZ, and NightBroker claiming a SQL-injection extraction of Pachatours (French Hajj and beach-holiday tour operator) databases totaling roughly 2GB and 31,087 unique individuals, including alleged plaintext passport numbers, payment-card transactions, and cleartext B2B travel-agency credentials. Pachatours had not publicly confirmed at catalog time. BreachHistory indexes the actor-cited 31,087 count as unverified.
Root cause
Unverified actor misere/ChimeraZ claim of full database extraction via SQL injection on Pachatours (pachatours.fr) travel operator—company had not confirmed at catalog time