2026 SOS Villages (TF1) — LunarisSec IDOR claim; ~260k listings + hidden contacts (unverified)
Data compromised
Listing metadata plus contact names, emails, phones including fields marked not for public display (actor/sample claims; unverified)
Technical writeup
Unverified claim: LunarisSec alleged ~260,000 SOS Villages (TF1 Info) listing records obtained in part via an IDOR that exposed emails/phones users chose not to display publicly, beyond scrapeable public fields. Cyberattaque.org reviewed samples; the site was reported offline Sunday evening. TF1/SOS Villages had not issued a matching confirmation at indexing. recordsAffected 260000; companyConfirmed false.
Root cause
Unverified LunarisSec claim of IDOR exposing non-public emails/phones on SOS Villages listings (Aug 2026)