---
title: "Data breach at L'Orange Bleue"
description: "An individual using the alias Venus1337 claimed on September 17, 2026, on a cybercrime forum, to be selling a database attributed to L'Orange Bleue, a French gym chain. According to the claim, the database contains records for 732,385 subscribers, including 440,326 IBANs, along with names, dates of "
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-17-l-orange-bleue
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-17
dateModified: 2026-09-17
---
# L'Orange Bleue

Data breach — Critical

An individual using the alias Venus1337 claimed on September 17, 2026, on a cybercrime forum, to be selling a database attributed to L'Orange Bleue, a French gym chain. According to the claim, the database contains records for 732,385 subscribers, including 440,326 IBANs, along with names, dates of birth, addresses, phone numbers, email addresses and profile photos linked to accounts. The actor claims to have gained access to a club administration tool and then exploited an IDOR vulnerability to export the data without authentication. As of now, L'Orange Bleue has not publicly confirmed the incident.

Combining bank account details (IBAN) with full identity data can facilitate fraud attempts or social engineering targeting the individuals concerned.

| Fact | Value |
| --- | --- |
| Disclosed on | September 17, 2026 |
| Accounts affected | 732,385 |
| Sector | Retail |
| Country | France |
| Cause | Misconfigured database |
| Severity | Critical |
| Status | Reported |

## Exposed data

- Full name
- Date of birth
- Postal address
- Phone number
- Email address
- Banking data (IBAN, card)
- Customer ID

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Orange Bleue](https://frenchbreaches.com/alertes/orange-bleue-mu6sr6lm5tsbb71uwjf) — FrenchBreaches
- [L'Orange Bleue : fuite de données revendiquée visant 732 385 adhérents](https://fuitesinfos.fr/article/2026-09-17-l-orange-bleue) — Fuites Infos
- [L'Orange bleue : 732 000 fiches d'adhérents et 440 000 IBAN dans une fuite massive après une cyberattaque](https://www.cyberattaque.org/lorange-bleue-732-000-fiches-dadherents-et-440-000-iban-dans-une-fuite-massive-apres-une-cyberattaque/) — Cyberattaque.org

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-17-l-orange-bleue
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees