Vehicle inspection data: three incidents in two weeks, eighteen years of records

A low-profile supplier, eighteen years of appointments

On 28 October 2026, the home page of auto-planning.fr was replaced by a ransom message. The attackers demanded $33,333 within seventy-two hours, and offered, incidentally, to help the company fix the flaws they said they had exploited¹.

Auto-Planning is not a household name. The company supplies online booking and SMS reminder tools to vehicle inspection centres, garages and driving schools. It is these tools, rather than the centres' own systems, that concentrate booking data from several networks at once.

What is claimed, and what is confirmed

The distinction is worth holding firmly, because it changes what a reader can conclude.

On the claims side, the attackers announce more than 200 million lines of data, including 91,824,920 appointments covering 791 centres, around 18 million unique identities after deduplication, 13.9 million registration plates, and 36,545 PDF invoices that may contain bank details. The records reportedly go back to 2008. Source code and access credentials for some services are also claimed¹.

FrenchBreaches, the specialist site that revealed the case on 29 October, says it received statistics, a list of centres and samples, without republishing any personal data. It also notes an inconsistency in the attackers' own inventory, whose header announces 60 gigabytes while the detailed listing describes 19.9.

On the confirmation side, the company acknowledged the attack to BFM Tech on 30 October without validating its scope, and said it had contacted France's data protection authority². As early as 29 October, specialist coverage noted explicitly that the announced volumes had not been confirmed by Auto-Planning³.

The figures in this article therefore remain estimates drawn from material supplied by the attackers. Acknowledging an intrusion is not validating the inventory of those who carried it out.

What remains unknown is just as notable: which centres are affected, what was actually copied, and whether individuals have been told.

DEKRA and Auto-Planning: two incidents, an uncertain link

Eight days before the ransom page, on 20 October, another incident hit the sector. DEKRA Automotive, which operates the DEKRA, Norisko and Autocontrol networks, reported unauthorised access to personal data at one of its subcontractors. The data concerned are the names, email addresses and phone numbers of people who booked an inspection on dekra-norisko.fr. The company says it notified the data protection authority and filed a complaint⁴.

It has not named the subcontractor, said how many people are concerned, or given the period covered.

Auto-Planning lists DEKRA among its client networks, alongside Autovision, Autosur, Sécuritest and Norisko⁵. A single incident is therefore plausible. It is not established, and neither party has said anything that would settle it.

For a motorist, the outcome is the same either way: they know vehicle inspection data has leaked, and they do not know whether they are in it.

Why appointments from 2008 would still be reachable

This is the part I find most instructive, provided the question is put correctly.

A booking tool needs to know who is coming when. It has no routine functional need to consult a motorist's appointment from 2008. Prolonged retention may nonetheless serve other legitimate purposes, and sometimes legal obligations: accounting documents, invoices included, must be kept for ten years under French law.

The question is therefore not whether this data should have been destroyed, but where it was held. France's data protection authority distinguishes the active database, consulted day to day, from intermediate archiving, where data is kept for an obligation or possible litigation, with access restricted to a small number of people and a logical or physical separation⁶. A 2015 invoice must be retained; it does not have to remain reachable from the booking application.

Public information does not allow anyone to say whether the old records claimed came from a production database, from backups, from archives, or from several sources at once. That is precisely what would need to be known.

One general observation survives regardless of this case. Emptying a database costs development time and returns nothing. Keeping it costs little in storage and feeds reminder campaigns. The risk only materialises once, on the day of the intrusion, and it is then multiplied by the number of years accumulated.

MD5 for passwords, in 2026

Of the 572 password hashes examined by FrenchBreaches, 161 were reportedly recovered. The algorithm used is MD5¹. The sample does not support concluding that every account used that algorithm, or that all passwords were exfiltrated.

Two distinct criticisms of MD5 are often conflated. The first concerns its collision resistance, broken in practice by the mid-2000s: that disqualifies the algorithm for signatures and certificates, less directly for password storage. The second, which matters here, is its speed. MD5 was designed to compute fast, with no cost parameter allowing each attempt to be deliberately slowed. Consumer graphics cards run through billions of combinations per second, which makes exhaustive testing affordable.

Salting is a separate requirement, which MD5 does not technically preclude. The French authority treats the two failings separately: it places MD5 and SHA-1 among obsolete algorithms, and separately lists hashing without a salt as a mistake in its own right. For passwords it names bcrypt, scrypt, Argon2 and PBKDF2⁶.

The significance of this detail goes beyond the case at hand. A recovered password is rarely useful on the original site, which has little value, but often elsewhere, because reuse remains the norm.

Responsibility split between the centres and their supplier

Which brings up the question a motorist eventually asks: who should they contact to find out whether they are affected?

The answer is less simple than it looks. In a standard arrangement, the inspection centre determines the purposes of the booking processing and is its controller; the supplier acts as processor, on the centre's behalf. But that classification depends on the contracts and on how the service actually works. A supplier can be a processor for bookings made on the centres' behalf while being a controller for other processing it carries out for itself, and joint controllership remains possible. Nor do the 791 establishments listed in the files amount to 791 separate controllers: a network may group several centres under one legal entity, and Auto-Planning states that it currently serves more than 450 centres.

The notification chain is not automatic either. The processor alerts the controller without undue delay, and may notify the authority on its behalf where the contract provides for it. The controller documents the breach internally where it is unlikely to result in a risk; notifies the authority, where feasible within seventy-two hours of becoming aware, where a risk exists; and additionally informs the individuals concerned where the risk is high, subject to exceptions⁷.

On paper the mechanism holds. In a chain where a single supplier serves hundreds of operators, it dissolves. An inspection centre rarely has the legal resources to assess the risk, and has no way of identifying which of its customers appear in a file it has never seen. A data protection officer can be external or shared, but one still has to exist and be consulted.

That is one reason why there is, to date, no simple way for an individual to find out whether they are concerned.

A sector that keeps returning to the news

French vehicle inspection is far from its first breach.

On 16 March 2025, Autosur lost more than 12.3 million lines covering 10,730,508 customers: identities, hashed passwords and session tokens, serial numbers and plates, inspection histories and internal data on the centres. The file was put up for sale on the darknet for five to seven and a half thousand dollars, payable in monero⁸. Another leak was reported in June 2026⁹.

On 31 October 2026, three days after the Auto-Planning ransom page, a database attributed to autosur.fr was offered for sale on a criminal forum: 798,502 lines covering 615,233 people, with names, phone numbers and email addresses. SECTA, which operates the network, said its systems had detected the incident, that its teams had isolated the system, and that it had notified the authority and filed a complaint. Around fifty centres are reportedly concerned. The company has not confirmed that the database for sale came from that incident, and the data structure differs from the earlier leaks⁹.

Three separate incidents in twelve days in the same sector, five in twenty months. A structural explanation suggests itself, without being proven by these cases alone: personal data that is mandatory to provide, since inspection is compulsory, collected by a network of independent operators, and entrusted to a small number of specialist suppliers. Each supplier then becomes a point of concentration for several million people. The hypothesis would be worth testing against other sectors organised the same way.

What this data actually enables

The value of such a file is not in reselling identities, which are worth little. It lies in the combination.

A name, a mobile number, a registration plate, the date of an appointment and the name of the centre that carried it out are enough to write a message a recipient has almost no reason to doubt. The precedent exists: after the March 2025 Autosur breach, names and plates fed fake toll payment demands⁵.

The scenarios already identified revolve around the same method. A fake reminder that the inspection has expired, with a payment link; a fake re-inspection booking carrying online fees; a fake fine notice bearing the name of France's traffic offence agency. One simple marker helps: a fine is served by post or handed over on the road, never by a message demanding payment within forty-eight hours.

Nothing establishes at this stage that a campaign in progress is drawing on these particular files. The risk is documented by the precedent.

What remains to be done, and by whom

For an individual, the useful measures are modest but real: treat any message about an inspection, a re-inspection or a fine as suspect as soon as it asks for payment, never use the link provided, and check directly with the centre or on the official site. If a password was created on a booking platform and reused elsewhere, change it everywhere.

For the centres, the obligation is heavier than they probably realise: ask their supplier whether their customers appear in the affected files, then assess the risk and act on it. Few will, for want of knowing they must.

For suppliers in the sector, this affair raises a question any of them can put to themselves now: how many years of appointments does the production database hold, and what would today stop access to the application from reaching the archives. The answer does not always come down to one setting, since it involves retention periods, archive separation and backups. It does, however, get built before the intrusion rather than after.

Sources & notes

1. FrenchBreaches, "Cyberattaque Auto-Planning : données, rançon", published 29 October 2026, updated 2 November 2026 (in French), https://frenchbreaches.com/alertes/cyberattaque-auto-planning-auto-controle-paris-donnees-rancon-mvsr5k8z732ik7zcded ↩ ↩² ↩³

2. Fuites Infos, "Auto-Planning : fuite de données après une cyberattaque sur ses sites", 2 November 2026 (in French), https://fuitesinfos.fr/article/2026-10-28-auto-planning ↩

3. Cyberattaque.org, "Auto-Planning : 14 millions de plaques d'immatriculation revendiquées par des pirates", 29 October 2026 (in French), https://www.cyberattaque.org/auto-planning-14-millions-de-plaques-dimmatriculation-revendiquees-par-des-pirates/ ↩

4. Fuites Infos, "DEKRA, Norisko, Autocontrol : des données de clients exposées après un incident chez un sous-traitant", 2 November 2026 (in French), https://fuitesinfos.fr/article/2026-11-02-dekra-automotive ↩

5. JeChange, "« Contrôle technique expiré » : derrière le SMS, les données revendiquées de 18 millions de personnes en vente", 31 October 2026 (in French), https://www.jechange.fr/assurance/auto/news/fuite-auto-planning-14-millions-plaques-faux-sms-controle-technique-expire-135-euros ↩ ↩²

6. CNIL, "Sécurité : chiffrement, hachage, signature" (in French), https://www.cnil.fr/fr/securite-chiffrement-hachage-signature ↩ ↩²

7. Regulation (EU) 2016/679 (GDPR), Articles 33 and 34, https://eur-lex.europa.eu/eli/reg/2016/679/oj ↩

8. ZATAZ, "Fuite massive de données chez AUTOSUR : plus de 12 millions de dossiers exposés", 23 March 2025, updated 27 March 2025 (in French), https://www.zataz.com/fuite-massive-de-donnees-chez-autosur-plus-de-12-millions-de-dossiers-exposes/ ↩

9. Fuites Infos, "Autosur : fuite revendiquée de 615 233 personnes après un piratage présumé", 31 October 2026, updated 1 November 2026 (in French), https://fuitesinfos.fr/article/2026-10-31-autosur ↩ ↩²