WayToMe
ModerateReportedTransport and travel
An individual using the alias Quantique claimed, on September 20, 2026 on a cybercriminal forum, to have extracted data from WayToMe, a carpooling and parcel-delivery platform. The claim describes broad access obtained to a Supabase instance used by the platform, yielding several files totaling 669,445 records, including a file of 147,287 user accounts (display names, internal identifiers, verification status, device information) and a file of 153,837 notifications containing recipient email addresses. A separate file of 363,274 trips contains geolocation data tied to users' movements. The claim has not been confirmed by WayToMe's operator at this stage.
If the claim proves accurate, cross-referencing trip records with user accounts could allow a third party to reconstruct the movements of some affected individuals.
- Disclosed on
- September 20, 2026
- Accounts affected
- 147,287
- Sector
- Transport and travel
- Country
- France
- Cause
- Misconfigured database
Exposed data
- Email address
- Full name
- Customer ID
- Connection data (IP, logs)
- Order history
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact