---
title: "Data breach at Colec"
description: "An individual using the alias DaOnlySpark claimed on 28 September 2026 to have leaked 3.36 GB of data from Colec, a French circular-economy and reuse platform, on a forum used by cybercriminals. Samples reviewed show account data for roughly 2,159 registered users: names, email addresses, cities, so"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-28-colec
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-28
dateModified: 2026-09-28
---
# Colec

Data breach — Moderate

An individual using the alias DaOnlySpark claimed on 28 September 2026 to have leaked 3.36 GB of data from Colec, a French circular-economy and reuse platform, on a forum used by cybercriminals. Samples reviewed show account data for roughly 2,159 registered users: names, email addresses, cities, sometimes full addresses, account identifiers, login information, and bcrypt-hashed passwords. Colec has not confirmed the incident as of this writing.

The exposed identifiers and login details could be used for targeted phishing attempts, and the hashed passwords, while not readable in plain text, remain exposed to offline cracking attempts.

| Fact | Value |
| --- | --- |
| Disclosed on | September 28, 2026 |
| Accounts affected | 2,159 |
| Sector | Digital services |
| Country | France |
| Cause | Undisclosed |
| Severity | Moderate |
| Status | Reported |

## Exposed data

- Email address
- Full name
- Postal address
- Customer ID
- Connection data (IP, logs)
- Password (hashed)

## What you can do

- Change that password — and everywhere you reused it. That is how a leak spreads to your other accounts.
- Turn on two-factor authentication on the affected accounts: a stolen password is then no longer enough.
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Colec](https://frenchbreaches.com/alertes/colec-mulppzyrqa4qwnvus7c) — FrenchBreaches
- [CO'LEC : fuite de données revendiquée visant 2 224 comptes utilisateurs](https://fuitesinfos.fr/article/2026-09-28-co-lec) — Fuites Infos

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-28-colec
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees