BumFot
ModerateConfirmedDigital services
On September 7, 2026, a database presented as originating from BumFot.fr, a French QR-code photo album sharing service, was published on a cybercriminal forum. The listing claims data on approximately 1,300 users, including names, email addresses, phone numbers, account identifiers, and registration/last-login dates. No passwords appear in the published sample. BumFot had not issued a public statement about the incident as of this writing.
The combination of name, email address and phone number in the same record makes it easier to craft convincing, targeted phishing or smishing messages.
- Disclosed on
- September 7, 2026
- Accounts affected
- 1,300
- Sector
- Digital services
- Country
- France
- Cause
- Undisclosed
Exposed data
- Full name
- Email address
- Phone number
- Customer ID
- Connection data (IP, logs)
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact