Association des maires de France (AMF) SQL-injection breach

Association des maires de France confirms a UNION-based SQL-injection breach exposing 114,000 records on mayors, municipal councillors and territorial agents, plaintext passwords included

France's Association des maires de France (AMF), the national association representing more than 34,000 member municipalities, confirmed on 2026-09-04 that its membership and subscription database at amf.asso.fr had been breached (Clubic, 2026-09-04; FrenchBreaches, 2026-09-04). An attacker using the handle "Alduin" claimed on a hacking forum to have exploited a UNION-type SQL-injection flaw against the amf.asso.fr web application to pull data from multiple database tables (FrenchBreaches, 2026-09-04). The claimed dataset totals roughly 114,000 entries (a single person can appear in multiple rows) covering names, municipality or intercommunality affiliation, job title, subscription type and dates (Clubic, 2026-09-04), and, per FrenchBreaches' own file analysis, professional and personal email addresses and internal identifiers tied to mayors, elected officials, municipal councillors, directors general of services and other territorial agents (FrenchBreaches, 2026-09-04). That same analysis found authentication data present across two distinct tables: bcrypt password hashes in one, and a separate table holding passwords stored in plaintext (FrenchBreaches, 2026-09-04); the source does not state whether the two tables cover the same account population, but the plaintext table alone is a basic-hygiene failure regardless: any account whose credentials landed in it had its password exposed in fully recoverable form. AMF has confirmed the incident and referred it to France's data-protection authority (CNIL) (Clubic, 2026-09-04); FrenchBreaches reports AMF is still scoping the leak's extent and says affected individuals will be notified once its internal audit concludes (FrenchBreaches, 2026-09-04). No patch, remediation timeline, or web-application-firewall/input-validation fix has been publicly stated by AMF as of this writing.

A UNION-based SQL injection against a membership or subscription portal is a textbook input-validation gap on a public-facing form or query parameter; the specific field or endpoint has not been named publicly. The combined dataset (identity, function, municipality data alongside a separate plaintext-credential table) enables both targeted spear-phishing of named mayors and directors general and credential-stuffing against any other portal where an affected individual reused a password exposed in the plaintext table.

Triage: no source describes what executed after the SQL injection succeeded, so no process-level or endpoint discriminator is offered here; the observable is at the web-application layer, database-query logs or a web-application firewall showing UNION SELECT patterns against the affected application's parameters, and unusually large result-set exports from a member-facing query endpoint that normally returns single-record lookups.