Uptoo
ModerateReportedEmployment and HR
An individual using the alias "akashi1337" has claimed since September 24, 2026, on a cybercriminal forum, to have accessed "Galaxy," the internal candidate-management platform of French recruitment firm Uptoo, and to hold more than 740,000 CVs and candidate records. The individual claims to have exploited an XSS flaw to obtain an admin token and then queried the platform's API to retrieve profiles and associated files. A sample reviewed by one outlet contains candidates' names, email addresses, phone numbers, and geographic preferences. Uptoo has not publicly confirmed the incident at this stage.
The contact details and CVs, if genuinely held, would allow a malicious third party to run targeted phishing or impersonation attempts against the candidates concerned.
- Disclosed on
- September 24, 2026
- Sector
- Employment and HR
- Country
- France
- Cause
- Misconfigured database
Exposed data
- Email address
- Full name
- Phone number
- Employment data
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact