2026-09-07NOTABLEChimeraZ expands beyond its fire-and-rescue targets to a French department's job-seeker platform, exposing CVs and personal data for over 20,000 people
OnRecrute.EnAveyron.fr (Département de l'Aveyron employment platform) breach, September 2026
incident · incident:aveyron-onrecrute-chimeraz-breach-2026-09
ChimeraZ claims exfiltration of 23,381 records / 20,316 people plus ~1,499 PDF CVs from OnRecrute.EnAveyron.fr, the Département de l'Aveyron's employment platform, published 2026-09-05 on a cybercriminal forum; independently reviewed by FrenchBreaches and Cyberattaque.org (2026-09-06).
Coverage
1
first 2026-09-07 → last 2026-09-07
Latest activity
2026-09-07
ChimeraZ expands beyond its fire-and-rescue targets to a French department's job-seeker platform, exposing…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector · regions: europe
Sources cited
2
2 hosts
Defender insights
What each entry about OnRecrute.EnAveyron.fr (Département de l'Aveyron employment platform) breach, September 2026 tells a defender to do, newest first.
Story timeline
ATT&CK techniques (3 across 5 tactics)
3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
- Initial AccessValid Accounts · Exploit Public-Facing Application
- PersistenceValid Accounts
- Privilege EscalationValid Accounts
- StealthValid Accounts
- CollectionData from Information Repositories
Initial Access TA0001
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗
T1190Exploit Public-Facing Application×1
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗
Persistence TA0003
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗
Privilege Escalation TA0004
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗
Stealth TA0005
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗
Collection TA0009
T1213Data from Information Repositories×1
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).
Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗
Entries about OnRecrute.EnAveyron.fr (Département de l'Aveyron employment platform) breach, September 2026 (1)
Co-occurring entities
Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.
Where this entity is cited
Source distribution
- cyberattaque.org1 (50%)
- frenchbreaches.com1 (50%)