Colec
ModerateReportedDigital services
An individual using the alias DaOnlySpark claimed on 28 September 2026 to have leaked 3.36 GB of data from Colec, a French circular-economy and reuse platform, on a forum used by cybercriminals. Samples reviewed show account data for roughly 2,159 registered users: names, email addresses, cities, sometimes full addresses, account identifiers, login information, and bcrypt-hashed passwords. Colec has not confirmed the incident as of this writing.
The exposed identifiers and login details could be used for targeted phishing attempts, and the hashed passwords, while not readable in plain text, remain exposed to offline cracking attempts.
- Disclosed on
- September 28, 2026
- Accounts affected
- 2,159
- Sector
- Digital services
- Country
- France
- Cause
- Undisclosed
Exposed data
- Email address
- Full name
- Postal address
- Customer ID
- Connection data (IP, logs)
- Password (hashed)
You are only affected if you had an account or an order with this organisation.
What you can do
- Change that password — and everywhere you reused it. That is how a leak spreads to your other accounts.
- Turn on two-factor authentication on the affected accounts: a stolen password is then no longer enough.
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact