Someone using the handle ChimeraZ posted a French vehicle dataset for sale on a criminal forum over the weekend, and the sample files connect plate numbers to the people who own the cars.
French Breaches, a breach-tracking collective, examined the listing. It counts 847,064 unique registration plates alongside 506,003 email addresses and 474,906 phone numbers. Full names and postal addresses sit in the same tables. The seller’s screenshots carried no passwords, no bank details and no social security numbers.
A decade of records, and no named source
The oldest entries reach back to 2017 and the newest to 2026, which suggests a database that was quietly accumulating rather than a single stolen export.
Where the file came from remains open. ChimeraZ described only a vulnerable website and promised to name it once the flaws were patched. Nobody has claimed responsibility for the leak, and no agency has responded publicly.
Researchers have been careful not to pin it on the Systeme d’immatriculation des vehicules, the state-run registry known as SIV. A commercial portal, a parking operator or a garage chain would produce the same shape of data with far less scrutiny.
What a plate lookup now buys
The risk is straightforward. A registration number spotted in a car park or on a street becomes a route to a home address, a phone number and a name, without any need to touch the vehicle itself.
That combination feeds stalking, vehicle cloning and insurance fraud, and it is the same pattern behind earlier plate-data incidents in India and the United States. France’s privacy regulator has not opened a public inquiry.
Drivers have no way to opt out of a registry. The exposure sits with whichever operator held the file, and it will not surface until someone starts matching plates to addresses.
