---
title: "Data breach at Armurerie Douillet"
description: "On 6 October 2026, a user on a cybercriminal forum advertised the sale of 4.65 GB of data, or 7,546 files, which they attribute to the website of Armurerie Douillet, a French retailer specialised in hunting and shooting. The archive is said to contain about 1,900 FFTir licences and SIA-related docum"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-10-06-armurerie-douillet
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-10-06
dateModified: 2026-10-06
---
# Armurerie Douillet

Data breach — Critical

On 6 October 2026, a user on a cybercriminal forum advertised the sale of 4.65 GB of data, or 7,546 files, which they attribute to the website of Armurerie Douillet, a French retailer specialised in hunting and shooting. The archive is said to contain about 1,900 FFTir licences and SIA-related documents, 1,200 identity cards, 700 prefectural decisions on firearm possession, 400 files on acquired weapons, 300 proofs of address, bank details or card-related documents, and 200 passports. According to FrenchBreaches, access reportedly came through an IDOR vulnerability exploited from a customer account without two-factor authentication, which has not been independently confirmed.

Copies of identity documents combined with an address and firearm-possession details would allow identity theft, fraud and targeted social engineering.

| Fact | Value |
| --- | --- |
| Disclosed on | October 6, 2026 |
| Incident dated | October 6, 2026 |
| Sector | Retail |
| Country | France |
| Cause | Credential stuffing |
| Severity | Critical |
| Status | Reported |

## Exposed data

- Identity document
- Full name
- Postal address
- Date of birth
- Banking data (IBAN, card)
- Customer ID
- Other personal data

## What you can do

- Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Armurerie Douillet](https://frenchbreaches.com/alertes/armurerie-douillet-muw77q13c7eazckgjfe) — FrenchBreaches

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-10-06-armurerie-douillet
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees