---
title: "Data breach at SAD'S Interim"
description: "The Rhysida ransomware group claims to have breached SAD'S Interim, a French temporary-staffing agency network employing more than 8,000 temporary workers a year, and published data samples on its leak site on September 8, 2026. A specialized outlet's analysis of those samples identified passport co"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-08-sad-s-interim
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-08
dateModified: 2026-09-08
---
# SAD'S Interim

Data breach — Critical

The Rhysida ransomware group claims to have breached SAD'S Interim, a French temporary-staffing agency network employing more than 8,000 temporary workers a year, and published data samples on its leak site on September 8, 2026. A specialized outlet's analysis of those samples identified passport copies, a national insurance number, a document related to disability recognition, payslips, and banking elements tied to SEPA transfers. Rhysida also claims to hold Vitale health insurance cards, France Travail certificates, temp-work contracts, and full payroll ERP backups, and has given a seven-day deadline before selling the full set to a single buyer.

The combination of identity documents, a national insurance number, and bank details exposes affected individuals to identity theft and fraud risk, including fraudulent changes to payroll bank details.

| Fact | Value |
| --- | --- |
| Disclosed on | September 8, 2026 |
| Sector | Employment and HR |
| Country | France |
| Cause | Ransomware |
| Severity | Critical |
| Status | Reported |

## Exposed data

- Identity document
- Social security number
- Health data
- Banking data (IBAN, card)
- Employment data

## What you can do

- Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- Health data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [SAD’S Interim : une cyberattaque expose passeports, NIR et données de santé](https://www.cyberattaque.org/sads-interim-une-cyberattaque-expose-passeports-nir-et-donnees-de-sante/) — Cyberattaque.org
- [Rhysida Ransomware Group Targets French Employment Agency SAD'S Interim](https://www.dexpose.io/rhysida-ransomware-group-targets-french-employment-agency-sads-interim/) — DeXpose
- [Victim: SAD'S Interim – rhysida](https://www.ransomware.live/id/U0FEJ1MgSW50ZXJpbUByaHlzaWRh) — Ransomware.live
- [[RHYSIDA] - Ransomware Victim: SAD'S Interim](https://www.redpacketsecurity.com/rhysida-ransomware-victim-sad-s-interim/) — RedPacket Security
- [Ransom! SAD'S Interim (SEP-2026)](https://www.hendryadrian.com/ransom-sads-interim-sep-2026/) — Hendry Adrian

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-08-sad-s-interim
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees