VD2E
ModerateReportedEnergy
An attacker using the name Alduin claims to have stolen about 86,000 customer and prospect records from VD2E, a French company that handles administrative procedures related to renewable energy and energy renovation. The records are reportedly offered for sale and cover August 2019 to October 2026. They appear to come from a customer relationship management tool. In a sample of 999 records, 981 contain a phone number, 914 an email address and 698 a postal address, along with names, cities and internal references. 816 records include a secondary contact (name, job title, email). The number of rows does not equal the number of distinct people: the sample holds only 763 distinct email addresses and 768 distinct phone numbers. The organisation has not confirmed the incident at this stage.
These contact details allow a malicious third party to target the people concerned with phishing or unsolicited approaches by email, SMS or phone, using their link to an energy renovation project.
- Disclosed on
- October 11, 2026
- Sector
- Energy
- Country
- France
- Cause
- Undisclosed
Exposed data
- Full name
- Postal address
- Phone number
- Email address
- Customer ID
- Employment data
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact