---
title: "Data breach at CAPEB (Confédération de l'artisanat et des petites entreprises du bâtiment)"
description: "On 2 October 2026, a user of a cybercriminal forum published a database presented as coming from capeb.fr, the website of the confederation representing craft businesses in the building trade. The poster claims 3,966,461 rows, about 2.48 GB, including 261,884 phone numbers and 253,636 email addresse"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-10-02-capeb-confederation-de-l-artisanat-et
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-10-02
dateModified: 2026-10-02
---
# CAPEB (Confédération de l'artisanat et des petites entreprises du bâtiment)

Data breach — Moderate

On 2 October 2026, a user of a cybercriminal forum published a database presented as coming from capeb.fr, the website of the confederation representing craft businesses in the building trade. The poster claims 3,966,461 rows, about 2.48 GB, including 261,884 phone numbers and 253,636 email addresses. The records reportedly link company representatives to their company name, SIRET number, postal address, activity, legal form, headcount and affiliated CAPEB union branch. The row count does not equal the number of people: the data may contain duplicates and several records per company. CAPEB has not confirmed the incident at this stage.

Business contact details linked to the names of company heads would let a third party target craftspeople with fraudulent solicitation, email or SMS phishing, or impersonation of a company.

| Fact | Value |
| --- | --- |
| Disclosed on | October 2, 2026 |
| Incident dated | October 2, 2026 |
| Sector | Nonprofits |
| Country | France |
| Cause | Undisclosed |
| Severity | Moderate |
| Status | Reported |

## Exposed data

- Full name
- Email address
- Phone number
- Postal address
- Employment data
- Customer ID

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [CAPEB](https://frenchbreaches.com/alertes/capeb-murke1g4sga4x80oopk) — FrenchBreaches
- [CAPEB : fuite de données revendiquée portant sur 3,97 millions de lignes](https://fuitesinfos.fr/article/2026-10-02-capeb) — Fuites Infos

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-10-02-capeb-confederation-de-l-artisanat-et
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees