Armurerie Douillet
CriticalReportedRetail
On 6 October 2026, a user on a cybercriminal forum advertised the sale of 4.65 GB of data, or 7,546 files, which they attribute to the website of Armurerie Douillet, a French retailer specialised in hunting and shooting. The archive is said to contain about 1,900 FFTir licences and SIA-related documents, 1,200 identity cards, 700 prefectural decisions on firearm possession, 400 files on acquired weapons, 300 proofs of address, bank details or card-related documents, and 200 passports. According to FrenchBreaches, access reportedly came through an IDOR vulnerability exploited from a customer account without two-factor authentication, which has not been independently confirmed.
Copies of identity documents combined with an address and firearm-possession details would allow identity theft, fraud and targeted social engineering.
- Disclosed on
- October 6, 2026
- Incident dated
- October 6, 2026
- Sector
- Retail
- Country
- France
- Cause
- Credential stuffing
Exposed data
- Identity document
- Full name
- Postal address
- Date of birth
- Banking data (IBAN, card)
- Customer ID
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact