CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

AFPA third-party accommodation-tool data extraction (September 2026)

incident · incident:afpa-third-party-accommodation-tool-data-extraction-2026-09

AFPA confirmed a potential data extraction, tied by its own investigation to a flaw in a third-party-hosted worker-accommodation-management tool outside its own IS, following criminal claims by xMetah (971,420 records) and Cybernox (1,732,811 records via an alleged IDOR) published 24 hours apart in mid-September 2026; up to 1.7 million people are potentially affected (AFP/franceinfo via Clubic, Cyberattaque.org, FrenchBreaches).

Coverage
1
first 2026-09-21 → last 2026-09-30
Latest activity
2026-09-21
AFPA links a potential data extraction to a flaw in a vendor-hosted tool after two criminal claims a day apart
Peak priority
routine
1 routine
Targets
public-sector
sectors: public-sector · regions: europe
Sources cited
3
3 hosts

Defender insights

What each entry about AFPA third-party accommodation-tool data extraction (September 2026) tells a defender to do, newest first.

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

related to

Story timeline

  1. 2026-09-21AFPA (France's national adult vocational-training agency) confirms a data extraction potentially affecting up to 1.7 million people, linked to a flaw in a third-party-hosted accommodation-management tool
    active-threatsAFPA links a potential data extraction to a flaw in a vendor-hosted tool after two criminal claims a day apart

Hunting pivots

Tags
data-breachorganized-crime
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • CollectionData from Information Repositories

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-21/afpa-third-party-accommodation-tool-data-extraction · ATT&CK page ↗

Collection TA0009

T1213Data from Information Repositories×1

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).

Evidence: 2026-09-21/afpa-third-party-accommodation-tool-data-extraction · ATT&CK page ↗

Entries about AFPA third-party accommodation-tool data extraction (September 2026) (1)

2026-09-21 · view entry permalink →

ROUTINEupdatedNATOB2

AFPA (France's national adult vocational-training agency) confirms a data extraction potentially affecting up to 1.7 million people, linked to a flaw in a third-party-hosted accommodation-management tool

AFPA, France's national public adult vocational-training agency, confirmed a potential extraction of identity, address and possibly phone-number data on up to 1.7 million people after the handles xMetah and Cybernox claimed 971,420 and 1,732,811 records a day apart in mid-September 2026, figures FrenchBreaches warns must not simply be summed (Cyberattaque.org, updated 2026-09-19 · Clubic, 2026-09-20 · FrenchBreaches, updated 2026-09-19). AFPA says its first investigations found the potential extraction linked to a flaw in a third-party-hosted accommodation-management tool outside its own information system, a link it words cautiously, and it has neither confirmed the insecure direct object reference Cybernox describes nor established whether both datasets come from one environment (Clubic, 2026-09-20 · Cyberattaque.org, updated 2026-09-19). It is relevant as a European public agency exposed through a vendor-hosted administrative tool.

According to AFPA, the hacked application contained people's identity and address, and possibly their phone number, but "a priori" no banking data or Social Security number. (translated from French)

This tool 'is hosted by a third-party vendor and is external to our information system, so there was, a priori, no impact on AFPA's own services and information systems.' (translated from French)

Clubic

AFPA now confirms that a data extraction potentially took place and states that the incident could affect up to 1.7 million people. (translated from French)

Cyberattaque.org 2026-09-19
Correctionrun 2026-09-30T0639Z-auditprioritysourcing_notebodytitleheadlinesummary

AFPA's statement is hedged: its first investigations found a "potential" data extraction that it links to a flaw in a vendor-hosted accommodation-management tool, and it has not established whether the two claimed datasets were taken from a single environment (Clubic, 2026-09-20). The entry previously said AFPA had traced the extraction to that flaw and that both claims pointed to it.

incident21 Sep 04:48Zmulti-sourceOpen finding →
Sources: Clubic (relaying AFP/franceinfo, quoting AFPA deputy director Pierre Prady directly) · Cyberattaque.org · FrenchBreaches

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • clubic.com1 (33%)
  • cyberattaque.org1 (33%)
  • frenchbreaches.com1 (33%)
All cited sources (3)