Faktus
CriticalConfirmedBanking and finance
Faktus, a French invoice-financing company serving companies including in the construction sector, had its systems reportedly compromised on 10 September 2026 by an attacker using the alias DaOnlySpark, who claims to have exfiltrated 53.7 GB of data before demanding a ransom that went unpaid. Data published on 19 September reportedly includes client accounts, professional contacts drawn from the HubSpot and Pipedrive CRMs, and financial and identity documents. Samples reviewed by specialist media show names, emails, phone numbers, hashed (bcrypt) passwords, bank details and identity documents. Faktus had not publicly confirmed the incident at the time this entry was written.
The combination of bank details, identity documents and professional contacts exposes affected individuals to targeted fraud or identity-theft attempts, including messages impersonating Faktus or its banking partners.
- Disclosed on
- September 19, 2026
- Incident dated
- September 10, 2026
- Accounts affected
- 105,251
- Sector
- Banking and finance
- Country
- France
- Cause
- Ransomware
Exposed data
- Email address
- Full name
- Phone number
- Employment data
- Banking data (IBAN, card)
- Identity document
- Password (hashed)
You are only affected if you had an account or an order with this organisation.
What you can do
- Change that password — and everywhere you reused it. That is how a leak spreads to your other accounts.
- Turn on two-factor authentication on the affected accounts: a stolen password is then no longer enough.
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
- FaktusFrenchBreaches
- Faktus : 53,7 Go de données financières et documents sensibles publiésCyberattaque.org
- Facturation électronique : une fuite de données touche un cador de l'écosystème comptable au pire des momentsPresse-citron
- Après une série de fuites de données dans le secteur public, la cybersécurité s'invite au cœur du lancement de la facturation électroniqueL'Usine Digitale
- Faktus : fuite de données revendiquée de 53,7 GoFuites Infos
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact