A recurring wave of data-leak claims against French departmental fire-and-rescue services (SDIS) hits seven more units, with SDIS du Gard confirming a theft; separately, SDIS 66 confirms a theft that forced crews back to paper and radio
SDIS 66 confirms theft of patient rescue forms; crews are back to paper and radio
Analysis
Over the last weekend of August 2026 a criminal actor published fresh data-leak claims against seven more French Services départementaux d'incendie et de secours (Somme, Essonne, Bas-Rhin, Bouches-du-Rhône, Gard, Vosges and Moselle), extending a campaign ZATAZ first documented in late July 2026 against five other SDIS (Aisne, Alpes-de-Haute-Provence, Landes, Marne, Alpes-Maritimes), where postings were attributed to three separate criminal-forum handles: ChimeraZ, Cybernox and AplaGroup (ZATAZ.COM, 2026-08-30). Of the August wave, Objectif Gard names only ChimeraZ, tying the same handle to five of the seven units (Gard, Bouches-du-Rhône, Moselle, Bas-Rhin and Vosges); no source names an actor for the Somme or Essonne claims, or ties Cybernox or AplaGroup to this wave. This is not merely a criminal claim: contacted directly on 30 August, the president of SDIS du Gard's governing board confirmed the cyberattack and theft of personal data on personnel, with copies of identity documents and bank details said to be among it, and the full scope and intrusion method still under investigation (Objectif Gard, 2026-08-30).
No common intrusion vector has been established across the incidents in this campaign. The one case with a stated mechanism is from the July wave: SDIS de l'Aisne, where a claimed administrator-level access credential was posted in cleartext by the actor; ZATAZ notes its current validity cannot be established from the post alone, since access can be disabled or changed after disclosure, but the posting itself is a more critical indicator than a plain directory extraction (ZATAZ.COM, 2026-07-26). The July wave's cumulative claims, spanning the Landes, Marne (2,167 people), Alpes-Maritimes (2,325 people), Alpes-de-Haute-Provence and Aisne SDIS, plus separate claims against SDIS d'Indre-et-Loire (2,637 public-service agents plus 54 individuals linked to private structures) and the Pompiers.fr / Fédération nationale des sapeurs-pompiers de France membership platform (ZATAZ.COM, 2026-07-26), totalled at least 166,376 exposed individuals, with a potential total exceeding 932,376 depending on the volumes claimed; ZATAZ is explicit that this estimate is a straight sum of announced record counts and does not mean each line was technically verified or maps to a distinct person (ZATAZ.COM, 2026-08-30). Each publication in the campaign otherwise appears to be a distinct claim rather than evidence of one coordinated technical compromise.
Cited evidence
SDIS du Gard was indeed the victim of a cyberattack and data theft. Contacted this Sunday 30 August by Objectif Gard, Alexandre Pissas, chairman of SDIS 30's board, confirms the computer attack and the theft of personal data concerning personnel. (translated from French)
Among the stolen information are said to be particularly sensitive data, notably copies of identity documents and bank details. (translated from French)
this data can help map personnel, roles, technical structures, hierarchical relationships and digital infrastructure of the French rescue services (translated from French)
SDIS 66 confirms it was the victim of a data theft. (translated from French)
the forms are now written by hand and transmissions are made by radio (translated from French)
Updates1
SDIS 66, the fire and rescue service of the Pyrénées-Orientales, confirmed to Radio France on 2026-10-01 that data was stolen from one of its servers, which is maintained by a technical provider (ICI / Radio France, 2026-10-01). The data includes the rescue forms crews fill in at a patient's home or an accident scene, which can hold medical data, intervention reports, contact details and copies of identity documents or Vitale health-insurance cards, and SDIS 66 says the nature and extent are still being identified (ICI / Radio France, 2026-10-01). A crisis cell was opened and the system that transmits the documents was blocked to stop further leakage, so the forms are now written by hand and transmitted by radio to keep rescue operations running (ICI / Radio France, 2026-10-01). On 2026-09-30 a forum user claimed nearly 120,000 records and 100,000 documents, figures ICI says cannot be verified, and ICI notes the incident comes a month after the SDIS du Gard attack (ICI / Radio France, 2026-10-01). The reporting names no intrusion vector and no actor, and no source links the SDIS 66 theft to the SDIS du Gard attack or to the forum claims against other units.
Sources4
Revision history
- Published 2026-08-31T0411Z-intel
- Update 2026-10-02T0404Z-intel
SDIS 66 confirmed on 2026-10-01 that data was stolen from a provider-maintained server that holds patient rescue forms, which can contain medical data and identity-document copies, and that crews now work on paper and radio; a forum claim of nearly 120,000 records is unverified. ICI notes it comes a month after the SDIS du Gard attack; no source links the two or names an actor. The earlier text now says the identity-document and bank-detail theft at SDIS du Gard is reported as said to be among the stolen data.
Changed: title headline summary entities sources evidence sourcing_note body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.