Skip to content
InYourGeek
visiteur@inyourgeek — shell
↹ compléter↑↓ historique⏎ ouvrirhelp
FR
← Back to the register

Agence de services et de paiement (ASP)

CriticalConfirmedPublic sector

The Agence de services et de paiement (ASP), a French public body that disburses aid on behalf of local authorities, suffered fraudulent access to a user account on 27 August 2026 on the portal for the Île-de-France region's "Coup de pouce énergie" energy support scheme, detected the next day. Administrative documents were exfiltrated, affecting according to cross-checked reporting over 143,000 beneficiaries in Île-de-France and Provence-Alpes-Côte d'Azur. The exposed data links identity, postal address, beneficiary number and bank details (IBAN/BIC) to the amounts of aid paid. This is the ASP's second security incident in 2026, after an earlier fraudulent access in April.

Linking an identity, an address and an IBAN to an actual aid amount paid enables credible phishing or social-engineering attempts impersonating the ASP, the Region or a bank.

Disclosed on
September 24, 2026
Incident dated
August 27, 2026
Accounts affected
143,518
Sector
Public sector
Country
France
Cause
Credential stuffing

Exposed data

  • Full name
  • Postal address
  • Customer ID
  • Banking data (IBAN, card)

You are only affected if you had an account or an order with this organisation.

What you can do

  • Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
  • You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

Sources

Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact