---
title: "Data breach at Whoof"
description: "On September 19, 2026, an attacker using the alias DaOnlySpark claimed to have breached Whoof, a French platform connecting dog adopters with professional breeders. The published database allegedly covers roughly 4,800 to 5,000 people (account holders, adopters) and nearly 500 professional breeding "
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-19-whoof
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-19
dateModified: 2026-09-19
---
# Whoof

Data breach — Critical

On September 19, 2026, an attacker using the alias DaOnlySpark claimed to have breached Whoof, a French platform connecting dog adopters with professional breeders. The published database allegedly covers roughly 4,800 to 5,000 people (account holders, adopters) and nearly 500 professional breeding businesses. A published sample shows names, email addresses, account identifiers and bcrypt password hashes; the attacker also claims to hold breeder-related documents (ACACED training certificates, verification ID documents) and reservation/payment data. Whoof has not issued any statement on the incident so far.

The exposed identity documents and professional certificates could let a third party impersonate a breeder or Whoof to request a deposit or redirect a payment.

| Fact | Value |
| --- | --- |
| Disclosed on | September 19, 2026 |
| Accounts affected | 4,835 |
| Sector | Retail |
| Country | France |
| Cause | Undisclosed |
| Severity | Critical |
| Status | Reported |

## Exposed data

- Full name
- Email address
- Phone number
- Customer ID
- Connection data (IP, logs)
- Password (hashed)
- Employment data
- Identity document
- Order history

## What you can do

- Change that password — and everywhere you reused it. That is how a leak spreads to your other accounts.
- Turn on two-factor authentication on the affected accounts: a stolen password is then no longer enough.
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Whoof](https://frenchbreaches.com/alertes/whoof-mu8dyyqbqoaiqbzpoqr) — FrenchBreaches
- [Whoof : fuite de données revendiquée visant 4 835 personnes](https://fuitesinfos.fr/article/2026-09-19-whoof) — Fuites Infos
- [Whoof : 5 000 adoptants et éleveurs exposés après une cyberattaque](https://www.cyberattaque.org/whoof-5-000-adoptants-et-eleveurs-exposes-apres-une-cyberattaque/) — Cyberattaque.org

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-19-whoof
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees