CTIPilot

OnRecrute.EnAveyron.fr (Département de l'Aveyron employment platform) breach, September 2026

incident · incident:aveyron-onrecrute-chimeraz-breach-2026-09

ChimeraZ claims exfiltration of 23,381 records / 20,316 people plus ~1,499 PDF CVs from OnRecrute.EnAveyron.fr, the Département de l'Aveyron's employment platform, published 2026-09-05 on a cybercriminal forum; independently reviewed by FrenchBreaches and Cyberattaque.org (2026-09-06).

Coverage timeline
1
first 2026-09-07 → last 2026-09-07
Peak priority
notable
1 notable
Sources cited
2
2 hosts
Sections touched
1
active-threats
Co-occurring entities
2
see Co-occurring entities below
ATT&CK techniques
3
pinned v19.2 · see below

Hunting pivots

ATT&CK techniques
T1078T1190T1213
Affected products
Odoo
Tags
data-breachidentityorganized-crime

ATT&CK techniques

3 techniques observed across 1 entry, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗

Collection TA0009

T1213Data from Information Repositories×1

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).

Evidence: 2026-09-07/chimeraz-aveyron-onrecrute-breach · ATT&CK page ↗

Story timeline

  1. 2026-09-07ChimeraZ claims France's Département de l'Aveyron employment platform, exposing 20,000+ people's data including 1,499 CVs, a customer account without MFA, an IDOR flaw and a misconfigured Odoo database, per one of two trackers who reviewed the leak
    active-threatsChimeraZ expands beyond its fire-and-rescue targets to a French department's job-seeker platform, exposing CVs and personal data for over 20,000 people

Where this entity is cited

  • active-threats1

Source distribution

  • cyberattaque.org1 (50%)
  • frenchbreaches.com1 (50%)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (2)

Entries about OnRecrute.EnAveyron.fr (Département de l'Aveyron employment platform) breach, September 2026 (1)

2026-09-07 · view entry permalink →

NOTABLENATOC2

ChimeraZ claims France's Département de l'Aveyron employment platform, exposing 20,000+ people's data including 1,499 CVs, a customer account without MFA, an IDOR flaw and a misconfigured Odoo database, per one of two trackers who reviewed the leak

The threat actor ChimeraZ (a criminal-forum handle already tracked for a recurring data-theft campaign against French departmental fire-and-rescue services) claimed on 5 September 2026 to have exfiltrated and published data from OnRecrute.EnAveyron.fr, an employment and CV platform the Département de l'Aveyron operates through its Agence Départementale de l'Attractivité et du Tourisme (ADAT). Two independent breach-tracking outlets, FrenchBreaches and Cyberattaque.org, each state they obtained and personally analysed the leaked files rather than relaying the forum post, and both corroborate the same scope: 23,381 records covering 20,316 people, plus roughly 1,499 PDF documents (~451 MB) (predominantly job-seeker CVs) for a claimed total of ~465 MB (FrenchBreaches, 2026-09-06; Cyberattaque.org, 2026-09-06). Exposed fields include names, email addresses, phone numbers, postal codes and communes, plus (within the CVs specifically) dates of birth, driving-licence status, education, employment history and named former employers (FrenchBreaches, 2026-09-06). Cyberattaque.org notes several candidate profiles were created or updated as recently as August 2026, indicating the exposed data is live production data rather than a stale archive (Cyberattaque.org, 2026-09-06).

The two trackers diverge sharply on how access was obtained, and neither account is a victim statement. FrenchBreaches alone reports the mechanism as a compromised customer account lacking multi-factor authentication, combined with an IDOR (Insecure Direct Object Reference) flaw that reached a misconfigured Odoo database from which the data was extracted, and adds that no detection of the malicious activity has occurred to date (FrenchBreaches, 2026-09-06). Cyberattaque.org, which independently obtained and reviewed the same files, explicitly declines to confirm any mechanism, stating that the hacker did not specify the access method and that nothing in the leak establishes whether access came from the employment platform itself, its extranet, or another component of the wider "En Aveyron" ecosystem (Cyberattaque.org, 2026-09-06). No statement has been issued by the Département de l'Aveyron, the ADAT, or the platform operator as of this run.

ChimeraZ is already tracked for the SDIS fire-and-rescue campaign, tied by name to five of seven French departmental fire-and-rescue services (SDIS) hit in an August 2026 wave; an earlier July 2026 wave against five further SDIS was attributed only collectively to three handles including ChimeraZ, with no per-unit breakdown. This incident shows the same forum handle now reaching French departmental administrative services outside that vertical, via a suspected third-party customer-account foothold into a business-application (Odoo) backend rather than the fire-and-rescue-specific access this actor was previously observed using. The pattern (an outsourced business-application backend reachable through a customer account without MFA) is directly transferable to Swiss cantonal and communal administrations running comparable outsourced CRM- or ERP-backed citizen or partner portals.

Selon nos informations, la fuite aurait été rendue possible par la compromission d'un compte client dépourvu de double authentification, combinée à une faille IDOR donnant accès à une base de données Odoo mal configurée. Aucune détection de l'activité malveillante n'aurait eu lieu à ce jour. (translated from French: According to our information, the leak was made possible by the compromise of a client account lacking two-factor authentication, combined with an IDOR flaw granting access to a misconfigured Odoo database. No detection of the malicious activity has reportedly occurred to date.)

FrenchBreaches 2026-09-06

Le hacker ne précise toutefois pas la méthode utilisée pour obtenir ces informations. Rien ne permet à ce stade de déterminer si l'accès provient directement de la plateforme d'emploi, de son extranet ou d'un autre composant de l'écosystème En Aveyron. (translated from French: The hacker does not, however, specify the method used to obtain this information. Nothing at this stage allows us to determine whether the access came directly from the employment platform, its extranet, or another component of the wider En Aveyron ecosystem.)

Cyberattaque.org 2026-09-06

Le pirate ChimeraZ revendique les données de 20 316 personnes ainsi que près de 1 500 documents PDF, dont des CV contenant de nombreuses informations personnelles et professionnelles. (translated from French: The hacker ChimeraZ claims the data of 20,316 people plus nearly 1,500 PDF documents, including CVs containing extensive personal and professional information.)

FrenchBreaches 2026-09-06

Builds on: 2026-08-31/france-sdis-fire-rescue-data-leak-campaign

incident07 Sep 04:40Zmulti-sourceOpen finding ↗
Sources: FrenchBreaches · Cyberattaque.org