---
title: "Data breach at Uptoo"
description: "An individual using the alias \"akashi1337\" has claimed since September 24, 2026, on a cybercriminal forum, to have accessed \"Galaxy,\" the internal candidate-management platform of French recruitment firm Uptoo, and to hold more than 740,000 CVs and candidate records. The individual claims to have ex"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-24-uptoo
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-24
dateModified: 2026-09-24
---
# Uptoo

Data breach — Moderate

An individual using the alias "akashi1337" has claimed since September 24, 2026, on a cybercriminal forum, to have accessed "Galaxy," the internal candidate-management platform of French recruitment firm Uptoo, and to hold more than 740,000 CVs and candidate records. The individual claims to have exploited an XSS flaw to obtain an admin token and then queried the platform's API to retrieve profiles and associated files. A sample reviewed by one outlet contains candidates' names, email addresses, phone numbers, and geographic preferences. Uptoo has not publicly confirmed the incident at this stage.

The contact details and CVs, if genuinely held, would allow a malicious third party to run targeted phishing or impersonation attempts against the candidates concerned.

| Fact | Value |
| --- | --- |
| Disclosed on | September 24, 2026 |
| Sector | Employment and HR |
| Country | France |
| Cause | Misconfigured database |
| Severity | Moderate |
| Status | Reported |

## Exposed data

- Email address
- Full name
- Phone number
- Employment data

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Uptoo](https://frenchbreaches.com/alertes/uptoo-mufge8zlw34qomqu3h) — FrenchBreaches
- [Uptoo : 740 000 CV revendiqués après une cyberattaque](https://www.cyberattaque.org/uptoo-740-000-cv-revendiques-apres-une-cyberattaque/) — Cyberattaque.org
- [Uptoo : fuite de données revendiquée sur plus de 740 000 CV](https://fuitesinfos.fr/article/2026-09-24-uptoo) — Fuites Infos
- [Fuite revendiquée chez Uptoo : ce que doivent décider entreprises clientes, candidats et prestataires](https://kohenavocats.fr/2026/09/24/uptoo-fuite-cv-entreprises-candidats-decisions-2026/) — Kohen Avocats

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-24-uptoo
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees