CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

ChimeraZ

actor · actor:chimeraz single-source

Forum handle behind multiple data-leak postings against French departmental fire-and-rescue services (SDIS), including SDIS du Gard, Bouches-du-Rhône, Moselle, Bas-Rhin and Vosges in the July-August 2026 wave (ZATAZ, 2026-08-30); also claimed the Département de l'Aveyron's OnRecrute employment platform, exposing 20,316 people's data (FrenchBreaches, Cyberattaque.org, 2026-09-06).

Coverage
2
first 2026-08-31 → last 2026-10-02
Latest activity
2026-10-02
SDIS 66 confirms theft of patient rescue forms; crews are back to paper and radio
Peak priority
notable
2 notable
Targets
public-sector
sectors: public-sector · regions: europe
Sources cited
6
5 hosts
2026-08-312 appearances2026-09-07

Defender insights

What each entry about ChimeraZ tells a defender to do, newest first.

2026-08-31NOTABLESDIS 66 confirms theft of patient rescue forms; crews are back to paper and radio

2026-09-07NOTABLEChimeraZ expands beyond its fire-and-rescue targets to a French department's job-seeker platform, exposing CVs and personal data for over 20,000 people

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

attributed activity

Story timeline

  1. 2026-09-07ChimeraZ claims France's Département de l'Aveyron employment platform, exposing 20,000+ people's data including 1,499 CVs, a customer account without MFA, an IDOR flaw and a misconfigured Odoo database, per one of two trackers who reviewed the leak
    active-threatsChimeraZ expands beyond its fire-and-rescue targets to a French department's job-seeker platform, exposing CVs and personal data for over 20,000 people
  2. 2026-08-31A recurring wave of data-leak claims against French departmental fire-and-rescue services (SDIS) hits seven more units, with SDIS du Gard confirming a theft; separately, SDIS 66 confirms a theft that forced crews back to paper and radio
    active-threatsSDIS 66 confirms theft of patient rescue forms; crews are back to paper and radio

Hunting pivots

Affected products
Odoo
Tags
data-breach ×2organized-crime ×2identity
ATT&CK techniques (3 across 5 tactics)

3 techniques observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts · Exploit Public-Facing Application
  • PersistenceValid Accounts
  • Privilege EscalationValid Accounts
  • StealthValid Accounts
  • CollectionData from Information Repositories

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗

Collection TA0009

T1213Data from Information Repositories×2

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).

Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · 2026-08-31/france-sdis-fire-rescue-data-leak-campaign · ATT&CK page ↗

Entries about ChimeraZ (2)

2026-08-31 · view entry permalink →

NOTABLEupdatedNATOB2

A recurring wave of data-leak claims against French departmental fire-and-rescue services (SDIS) hits seven more units, with SDIS du Gard confirming a theft; separately, SDIS 66 confirms a theft that forced crews back to paper and radio

Over the last weekend of August 2026 a criminal actor published fresh data-leak claims against seven more French Services départementaux d'incendie et de secours (Somme, Essonne, Bas-Rhin, Bouches-du-Rhône, Gard, Vosges and Moselle), extending a campaign ZATAZ first documented in late July 2026 against five other SDIS (Aisne, Alpes-de-Haute-Provence, Landes, Marne, Alpes-Maritimes), where postings were attributed to three separate criminal-forum handles: ChimeraZ, Cybernox and AplaGroup (ZATAZ.COM, 2026-08-30). Of the August wave, Objectif Gard names only ChimeraZ, tying the same handle to five of the seven units (Gard, Bouches-du-Rhône, Moselle, Bas-Rhin and Vosges); no source names an actor for the Somme or Essonne claims, or ties Cybernox or AplaGroup to this wave. This is not merely a criminal claim: contacted directly on 30 August, the president of SDIS du Gard's governing board confirmed the cyberattack and theft of personal data on personnel, with copies of identity documents and bank details said to be among it, and the full scope and intrusion method still under investigation (Objectif Gard, 2026-08-30).

No common intrusion vector has been established across the incidents in this campaign. The one case with a stated mechanism is from the July wave: SDIS de l'Aisne, where a claimed administrator-level access credential was posted in cleartext by the actor; ZATAZ notes its current validity cannot be established from the post alone, since access can be disabled or changed after disclosure, but the posting itself is a more critical indicator than a plain directory extraction (ZATAZ.COM, 2026-07-26). The July wave's cumulative claims, spanning the Landes, Marne (2,167 people), Alpes-Maritimes (2,325 people), Alpes-de-Haute-Provence and Aisne SDIS, plus separate claims against SDIS d'Indre-et-Loire (2,637 public-service agents plus 54 individuals linked to private structures) and the Pompiers.fr / Fédération nationale des sapeurs-pompiers de France membership platform (ZATAZ.COM, 2026-07-26), totalled at least 166,376 exposed individuals, with a potential total exceeding 932,376 depending on the volumes claimed; ZATAZ is explicit that this estimate is a straight sum of announced record counts and does not mean each line was technically verified or maps to a distinct person (ZATAZ.COM, 2026-08-30). Each publication in the campaign otherwise appears to be a distinct claim rather than evidence of one coordinated technical compromise.

SDIS du Gard was indeed the victim of a cyberattack and data theft. Contacted this Sunday 30 August by Objectif Gard, Alexandre Pissas, chairman of SDIS 30's board, confirms the computer attack and the theft of personal data concerning personnel. (translated from French)

Among the stolen information are said to be particularly sensitive data, notably copies of identity documents and bank details. (translated from French)

Objectif Gard 2026-08-30

this data can help map personnel, roles, technical structures, hierarchical relationships and digital infrastructure of the French rescue services (translated from French)

ZATAZ.COM

SDIS 66 confirms it was the victim of a data theft. (translated from French)

the forms are now written by hand and transmissions are made by radio (translated from French)

ICI / Radio France 2026-10-01
Updaterun 2026-10-02T0404Z-inteltitleheadlinesummaryentitiessourcesevidencesourcing_notebody

SDIS 66, the fire and rescue service of the Pyrénées-Orientales, confirmed to Radio France on 2026-10-01 that data was stolen from one of its servers, which is maintained by a technical provider (ICI / Radio France, 2026-10-01). The data includes the rescue forms crews fill in at a patient's home or an accident scene, which can hold medical data, intervention reports, contact details and copies of identity documents or Vitale health-insurance cards, and SDIS 66 says the nature and extent are still being identified (ICI / Radio France, 2026-10-01). A crisis cell was opened and the system that transmits the documents was blocked to stop further leakage, so the forms are now written by hand and transmitted by radio to keep rescue operations running (ICI / Radio France, 2026-10-01). On 2026-09-30 a forum user claimed nearly 120,000 records and 100,000 documents, figures ICI says cannot be verified, and ICI notes the incident comes a month after the SDIS du Gard attack (ICI / Radio France, 2026-10-01). The reporting names no intrusion vector and no actor, and no source links the SDIS 66 theft to the SDIS du Gard attack or to the forum claims against other units.

threat31 Aug 05:00Zsingle-sourceOpen finding →
Sources: ZATAZ.COM (Damien Bancal) · Objectif Gard · ICI / Radio France

2026-09-07 · view entry permalink →

NOTABLENATOC2

ChimeraZ claims France's Département de l'Aveyron employment platform, exposing 20,000+ people's data including 1,499 CVs, a customer account without MFA, an IDOR flaw and a misconfigured Odoo database, per one of two trackers who reviewed the leak

The threat actor ChimeraZ (a criminal-forum handle already tracked for a recurring data-theft campaign against French departmental fire-and-rescue services) claimed on 5 September 2026 to have exfiltrated and published data from OnRecrute.EnAveyron.fr, an employment and CV platform the Département de l'Aveyron operates through its Agence Départementale de l'Attractivité et du Tourisme (ADAT). Two independent breach-tracking outlets, FrenchBreaches and Cyberattaque.org, each state they obtained and personally analysed the leaked files rather than relaying the forum post, and both corroborate the same scope: 23,381 records covering 20,316 people, plus roughly 1,499 PDF documents (~451 MB) (predominantly job-seeker CVs) for a claimed total of ~465 MB (FrenchBreaches, 2026-09-06; Cyberattaque.org, 2026-09-06). Exposed fields include names, email addresses, phone numbers, postal codes and communes, plus (within the CVs specifically) dates of birth, driving-licence status, education, employment history and named former employers (FrenchBreaches, 2026-09-06). Cyberattaque.org notes several candidate profiles were created or updated as recently as August 2026, indicating the exposed data is live production data rather than a stale archive (Cyberattaque.org, 2026-09-06).

The two trackers diverge sharply on how access was obtained, and neither account is a victim statement. FrenchBreaches alone reports the mechanism as a compromised customer account lacking multi-factor authentication, combined with an IDOR (Insecure Direct Object Reference) flaw that reached a misconfigured Odoo database from which the data was extracted, and adds that no detection of the malicious activity has occurred to date (FrenchBreaches, 2026-09-06). Cyberattaque.org, which independently obtained and reviewed the same files, explicitly declines to confirm any mechanism, stating that the hacker did not specify the access method and that nothing in the leak establishes whether access came from the employment platform itself, its extranet, or another component of the wider "En Aveyron" ecosystem (Cyberattaque.org, 2026-09-06). No statement has been issued by the Département de l'Aveyron, the ADAT, or the platform operator as of this run.

ChimeraZ is already tracked for the SDIS fire-and-rescue campaign, tied by name to five of seven French departmental fire-and-rescue services (SDIS) hit in an August 2026 wave; an earlier July 2026 wave against five further SDIS was attributed only collectively to three handles including ChimeraZ, with no per-unit breakdown. This incident shows the same forum handle now reaching French departmental administrative services outside that vertical, via a suspected third-party customer-account foothold into a business-application (Odoo) backend rather than the fire-and-rescue-specific access this actor was previously observed using. The pattern (an outsourced business-application backend reachable through a customer account without MFA) is directly transferable to Swiss cantonal and communal administrations running comparable outsourced CRM- or ERP-backed citizen or partner portals.

Selon nos informations, la fuite aurait été rendue possible par la compromission d'un compte client dépourvu de double authentification, combinée à une faille IDOR donnant accès à une base de données Odoo mal configurée. Aucune détection de l'activité malveillante n'aurait eu lieu à ce jour. (translated from French: According to our information, the leak was made possible by the compromise of a client account lacking two-factor authentication, combined with an IDOR flaw granting access to a misconfigured Odoo database. No detection of the malicious activity has reportedly occurred to date.)

FrenchBreaches 2026-09-06

Le hacker ne précise toutefois pas la méthode utilisée pour obtenir ces informations. Rien ne permet à ce stade de déterminer si l'accès provient directement de la plateforme d'emploi, de son extranet ou d'un autre composant de l'écosystème En Aveyron. (translated from French: The hacker does not, however, specify the method used to obtain this information. Nothing at this stage allows us to determine whether the access came directly from the employment platform, its extranet, or another component of the wider En Aveyron ecosystem.)

Cyberattaque.org 2026-09-06

Le pirate ChimeraZ revendique les données de 20 316 personnes ainsi que près de 1 500 documents PDF, dont des CV contenant de nombreuses informations personnelles et professionnelles. (translated from French: The hacker ChimeraZ claims the data of 20,316 people plus nearly 1,500 PDF documents, including CVs containing extensive personal and professional information.)

FrenchBreaches 2026-09-06

Builds on: SDIS 66 confirms theft of patient rescue forms; crews are back to paper and radio

incident07 Sep 04:40Zmulti-sourceOpen finding →
Sources: FrenchBreaches · Cyberattaque.org

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats2

Source distribution

  • zataz.com2 (33%)
  • cyberattaque.org1 (17%)
  • frenchbreaches.com1 (17%)
  • ici.fr1 (17%)
  • objectifsud.fr1 (17%)
All cited sources (6)