Hacker Chimeraz Claims 259 Million Records Stolen from SGS French Vehicle Inspection Operations

French hacker Chimeraz has listed for sale a large dataset allegedly taken from SGS French subsidiaries including Auto Sécurité, Sécuritest and Vérif’Autos. The claimed dump contains 259 million lines covering 22.7 million individuals and mixes vehicle technical data with personal contact information. Advertised volumes include 90.8 million vehicle entries, 74.7 million inspections, 29.2 million service records and 40.9 million distinct license plates. The seller also offers subsets linking names, phone numbers and email addresses to specific vehicles and past services. Data samples contain entries dated between 2016 and 2025. Chimeraz has previously claimed responsibility for breaches affecting French tourism operators and political parties. The authenticity of the SGS claim remains unverified by independent sources.

ZATAZTranslated from French

Read at source

Chimeraz, a hacker already tracked by French media, has posted an advertisement offering a dataset presented as originating from the French operations of Swiss inspection group SGS.

The listing claims approximately 259 million lines of data linked to 22,688,152 individuals. The files reportedly combine automotive characteristics with customer personal information from three major French vehicle inspection networks: Auto Sécurité, Sécuritest and Vérif’Autos.

According to the seller, the material covers 3,988 centres, 90.8 million vehicle entries, 74.7 million inspections and 29.2 million service records. It also lists 40,920,439 distinct license plates, of which roughly 13 million are associated with personal data, together with 9.5 million unique phone numbers and 4 million distinct email addresses.

The advertised records contain fields such as make, model, engine type, body style, fiscal horsepower and previous mileage. Inspection and service entries include timestamps, technical references and billing amounts linked to individual customers.

Chimeraz has previously claimed responsibility for leaks involving French tourism companies and several political parties. The current advertisement marks a shift in the hacker’s communication channels and has made the pseudonym one of the most sought-after on underground forums.

Independent verification of the claimed SGS breach has not yet been completed. The dates appearing in the samples range from 2016 to 2025, but these timestamps do not confirm when any intrusion or extraction occurred.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Breaches & Leaks

Kensium Faces Unverified Claim of 18TB Data Theft Including Source Code and AWS Backups
Ceres Discloses Data Breach at Point Income and CoinTrade Exposing Customer Records
Japan's Fire and Disaster Management Agency Suspends Anzen Joho System After Unauthorized Access Detected by Fujisoft