---
title: "Data breach at VD2E"
description: "An attacker using the name Alduin claims to have stolen about 86,000 customer and prospect records from VD2E, a French company that handles administrative procedures related to renewable energy and energy renovation. The records are reportedly offered for sale and cover August 2019 to October 2026. "
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-10-11-vd2e
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-10-11
dateModified: 2026-10-11
---
# VD2E

Data breach — Moderate

An attacker using the name Alduin claims to have stolen about 86,000 customer and prospect records from VD2E, a French company that handles administrative procedures related to renewable energy and energy renovation. The records are reportedly offered for sale and cover August 2019 to October 2026. They appear to come from a customer relationship management tool. In a sample of 999 records, 981 contain a phone number, 914 an email address and 698 a postal address, along with names, cities and internal references. 816 records include a secondary contact (name, job title, email). The number of rows does not equal the number of distinct people: the sample holds only 763 distinct email addresses and 768 distinct phone numbers. The organisation has not confirmed the incident at this stage.

These contact details allow a malicious third party to target the people concerned with phishing or unsolicited approaches by email, SMS or phone, using their link to an energy renovation project.

| Fact | Value |
| --- | --- |
| Disclosed on | October 11, 2026 |
| Sector | Energy |
| Country | France |
| Cause | Undisclosed |
| Severity | Moderate |
| Status | Reported |

## Exposed data

- Full name
- Postal address
- Phone number
- Email address
- Customer ID
- Employment data

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [VD2E : 86 000 fiches clients de la rénovation énergétique mises en vente sur le darkweb](https://www.cyberattaque.org/vd2e-86-000-fiches-clients-de-la-renovation-energetique-mises-en-vente-sur-le-darkweb/) — Cyberattaque.org

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-10-11-vd2e
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees