Auto-Planning: what the claimed automobile leak demonstrates

Claim reported October 29, 2026; status of sources as of November 4. FrenchBreaches, cited by Solutions Numériques, reports data samples attributed to Auto-Planning, service provider for making technical inspection appointments. The authors of the claim speak of very large volumes; 18 million people is an estimate after deduplication, not a total confirmed by the company. No public communications from Auto-Planning confirming the extent of the exfiltration were found in the sources reviewed.

Three levels of proof not to be mixed

First level: a claim of attackers, which describes a volume and an intrusion. It does not prove possession of each advertised line or persistent access. Second level: samples that FrenchBreaches says it has examined, including identity, telephone, plate and appointment. They can show that certain data has circulated; they do not allow mechanical extrapolation to the totality. Third level: a scope confirmed by the operator, absent from the public sources consulted. The cited media itself specifies that the samples are not sufficient to confirm all the claimed volumes.

The report mentions approximately 92 million alleged appointments, data dating back to 2008 and a close estimate of 14 million plates. These are figures from the reported analysis, not officially validated totals. The report also mentions MD5 password hashes in a sample. If confirmed, this would be a poor choice for protecting passwords: MD5 is fast to calculate, which favors offline testing after hash leaks. The report does not publish the complete authentication architecture, salting mode or initial vector; we cannot deduce a method of intrusion from this.

Why reconciling fields changes the risk

A license plate alone does not provide computer access. Associated with a name, a telephone number, a model and an appointment date, it can make a false SMS reminder of a technical inspection or fine credible. These are possible fraud scenarios, not confirmed abuse of this data. The technical interest of the file is aggregation: a service provider can host appointment records from many centers; the impact analysis must therefore match each record to its establishment, its age and its retention period, without concluding that each center has itself been hacked.

To transform this alert into an assessment, a declaration from the operator or independent expertise would be required specifying the access logs, exfiltrated tables, duplicates, dates and actually sensitive data. Until then, the article remains a assessment of the available evidence, with a clearly identified conditional risk. It will be corrected if a primary assessment is published.

Public source examined: Solutions Numériques report of November 2, 2026, based on the analysis reported by FrenchBreaches.