CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

xMetah

actor · actor:xmetah

Criminal-forum handle that first offered 971,420 records attributed to AFPA for sale on 2026-09-15, one day before Cybernox's separate, larger 1,732,811-record claim against the same agency; AFPA has not confirmed whether the two claimed datasets overlap (Cyberattaque.org, FrenchBreaches, Clubic, 2026-09-15/20).

Coverage
2
1 about it · 1 mention · first 2026-08-15 → last 2026-09-30
Latest activity
2026-09-21
AFPA links a potential data extraction to a flaw in a vendor-hosted tool after two criminal claims a day apart
Peak priority
routine
1 routine
Targets
public-sector
sectors: public-sector · regions: europe
Sources cited
15
11 hosts
2026-08-152 appearances2026-09-21

Defender insights

What each entry about xMetah tells a defender to do, newest first.

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

related to

Story timeline

Every entry that names xMetah, newest first. Rows tagged mention only name it in passing: they are listed for completeness and add nothing to the action items, pivots or ATT&CK profile on this page.

  1. 2026-09-21AFPA (France's national adult vocational-training agency) confirms a data extraction potentially affecting up to 1.7 million people, linked to a flaw in a third-party-hosted accommodation-management tool
    active-threatsAFPA links a potential data extraction to a flaw in a vendor-hosted tool after two criminal claims a day apart
  2. 2026-08-15France's tax authority says it cut the intruders' accounts in June and July and found no data theft; it took the criminal's sale listing two months later to establish that 678,000 records had already gone
    mentionactive-threatsDGFiP confirms a 678,000-record theft via a stolen agent account and a third party's credentials, missed by its own post-intrusion access checks

Hunting pivots

Tags
data-breachorganized-crime
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • CollectionData from Information Repositories

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-21/afpa-third-party-accommodation-tool-data-extraction · ATT&CK page ↗

Collection TA0009

T1213Data from Information Repositories×1

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).

Evidence: 2026-09-21/afpa-third-party-accommodation-tool-data-extraction · ATT&CK page ↗

Entries about xMetah (1)

2026-09-21 · view entry permalink →

ROUTINEupdatedNATOB2

AFPA (France's national adult vocational-training agency) confirms a data extraction potentially affecting up to 1.7 million people, linked to a flaw in a third-party-hosted accommodation-management tool

AFPA, France's national public adult vocational-training agency, confirmed a potential extraction of identity, address and possibly phone-number data on up to 1.7 million people after the handles xMetah and Cybernox claimed 971,420 and 1,732,811 records a day apart in mid-September 2026, figures FrenchBreaches warns must not simply be summed (Cyberattaque.org, updated 2026-09-19 · Clubic, 2026-09-20 · FrenchBreaches, updated 2026-09-19). AFPA says its first investigations found the potential extraction linked to a flaw in a third-party-hosted accommodation-management tool outside its own information system, a link it words cautiously, and it has neither confirmed the insecure direct object reference Cybernox describes nor established whether both datasets come from one environment (Clubic, 2026-09-20 · Cyberattaque.org, updated 2026-09-19). It is relevant as a European public agency exposed through a vendor-hosted administrative tool.

According to AFPA, the hacked application contained people's identity and address, and possibly their phone number, but "a priori" no banking data or Social Security number. (translated from French)

This tool 'is hosted by a third-party vendor and is external to our information system, so there was, a priori, no impact on AFPA's own services and information systems.' (translated from French)

Clubic

AFPA now confirms that a data extraction potentially took place and states that the incident could affect up to 1.7 million people. (translated from French)

Cyberattaque.org 2026-09-19
Correctionrun 2026-09-30T0639Z-auditprioritysourcing_notebodytitleheadlinesummary

AFPA's statement is hedged: its first investigations found a "potential" data extraction that it links to a flaw in a vendor-hosted accommodation-management tool, and it has not established whether the two claimed datasets were taken from a single environment (Clubic, 2026-09-20). The entry previously said AFPA had traced the extraction to that flaw and that both claims pointed to it.

incident21 Sep 04:48Zmulti-sourceOpen finding →
Sources: Clubic (relaying AFP/franceinfo, quoting AFPA deputy director Pierre Prady directly) · Cyberattaque.org · FrenchBreaches

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats2

Source distribution

  • zataz.com4 (27%)
  • presse.economie.gouv.fr2 (13%)
  • clubic.com1 (7%)
  • cyber.gouv.fr1 (7%)
  • cyberattaque.org1 (7%)
  • franceinfo.fr1 (7%)
  • frenchbreaches.com1 (7%)
  • occrp.org1 (7%)
  • other3 (20%)
All cited sources (15)