---
title: "Data breach at Communauto"
description: "Communauto, a Quebec-based car-sharing service, detected unusual activity on the night of September 3 to 4, 2026, linked to unauthorized use of an internal account by an employee who allegedly ran an automated script to access and download member records. About 2% of members, several thousand people"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-26-communauto
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-26
dateModified: 2026-09-26
---
# Communauto

Data breach — Critical

Communauto, a Quebec-based car-sharing service, detected unusual activity on the night of September 3 to 4, 2026, linked to unauthorized use of an internal account by an employee who allegedly ran an automated script to access and download member records. About 2% of members, several thousand people across Canada, are affected. The identity-verification documents potentially accessed may include name, date of birth, address, phone number, driver's licence number and photograph. Communauto states that passwords and payment data were not accessible, and a police investigation into the employee has been opened.

The combination of an identity document, a photo and personal contact details could facilitate identity theft or make targeted phishing attempts impersonating Communauto more convincing.

| Fact | Value |
| --- | --- |
| Disclosed on | September 26, 2026 |
| Incident dated | September 4, 2026 |
| Sector | Transport and travel |
| Country | Canada |
| Cause | Direct intrusion |
| Severity | Critical |
| Status | Confirmed |

## Exposed data

- Full name
- Date of birth
- Postal address
- Phone number
- Identity document

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Communauto](https://frenchbreaches.com/alertes/communauto-mui6jwgstgrtgydw18) — FrenchBreaches
- [Communauto warns customers of potential data breach involving personal information](https://www.ctvnews.ca/montreal/article/communauto-warns-customers-of-potential-data-breach-involving-personal-information/) — CTV News
- [Communauto data breach traced to employee's unauthorized script, company says](https://www.teiss.co.uk/news/communauto-data-breach-traced-to-employees-unauthorized-script-company-says-18169) — teiss
- [Communauto victime d'un piratage, les clients exposés à un risque d'usurpation d'identité](https://fr.finance.yahoo.com/actualites/communauto-victime-d-piratage-clients-161808589.html) — Yahoo Finance
- [Des clients de Communauto victimes d'un vol de données](https://www.noovo.info/nouvelles/societe/article/des-clients-de-communauto-victimes-dun-vol-de-donnees/) — Noovo Info

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-26-communauto
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees