Vackelys
CriticalReportedPublic sector
On 17 October 2026, an attacker claimed to be selling data taken from the Vackelys website: 3,553 people, 17,348 records and 2,070 files, totalling 5.75 GB. The samples shared with the outlet contain surnames, first names, participant identifiers and file names that mention a "valid passport". These are references to files, and the contents of the documents were not seen. The figures come solely from the attacker and have not been independently verified. Vackelys has not confirmed the incident.
If copies of passports were actually in the files, they could be used for identity theft or document fraud, but their presence has not been established.
- Disclosed on
- October 17, 2026
- Accounts affected
- 3,553
- Sector
- Public sector
- Country
- France
- Cause
- Undisclosed
Exposed data
- Full name
- Customer ID
- Identity document
You are only affected if you had an account or an order with this organisation.
What you can do
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact