-
A hacker called ChimeraZ claims to have posted data linked to nearly 15,000 Incognito.fr customers.
-
The sample reportedly shows names, titles, postal addresses, cities, and countries, but no proof of payment details.
-
Nobody has confirmed a cyberattack, and the company has not issued a confirmed statement.
A French online photo lab, Incognito.fr, now faces a data leak claim. The claim covers personal details of nearly 15,000 people. A threat actor, which means a hacker, shared the claim on a cybercriminal forum.
On Friday, October 30, 2026, a user called “ChimeraZ” reportedly posted a database there. ChimeraZ says the files came from the photo lab. The actor claims the dataset holds 21,353 records linked to 14,996 people.
Nobody has checked these claims independently yet. No confirmed evidence shows that Incognito.fr suffered a cyberattack. Nothing proves the posted database came from the company’s systems.
Hacker Posts Alleged Customer Database on Forum
The forum post carries a French tag and a title that names 14K Incognito.fr. ChimeraZ is a pseudonym, which means a made-up online name. A database is an organized collection of information. The title shows the actor named the photo lab directly. The actor says the post releases one of about 2 MB. The post also includes several file-sharing links. The file uses the CSV format, which is a simple table saved as plain text.
A sample is a small part of a larger file. The sample reportedly lists several personal details. These include first names, last names, and titles. They also include postal addresses, postal codes, cities, and countries. One more field appears to be a folder code or an office reference.
The two numbers in the claim do not match. The actor mentions 21,353 records but only 14,996 people. A record is one entry in the database. This gap suggests that some people may appear more than once. Still, the real layout and contents of the database remain unknown.
The sample leaves many questions open. The sample is the only part of the data described so far. It does not show whether phone numbers or email addresses were included. It also does not show payment details or full order histories. Nothing confirms that anyone accessed customer photos or uploaded image files.
According to its official website, Incognito runs an online photo lab. The lab serves individuals and professional photographers. The company says it has operated since 1992. It offers photo printing, enlargements, posters, and other printing services. It also handles customer photos for printing and delivery.
The privacy policy says the company uses customer information to manage orders and deliveries. The policy also names the company and a related entity as recipients of that information.
Scam Risks Could Follow If the Leaked Data is Real
Names and home addresses could help scammers if the database is authentic. Such details could open the door to targeted scams. A targeted scam aims at specific people instead of the general public. Similar data-exposure claims have also emerged in India, where a hacker claimed nearly 70,000 student records were exposed in a data leak.
Criminals could pretend to be a delivery company. They could also contact customers about photo orders that supposedly arrived late. Some might send fake payment requests. The leaked details could also make phishing messages look more convincing. Phishing means using fake messages to trick people into giving money or private details.
Cybermalveillance.gouv.fr is France’s national cybersecurity help platform. It lists targeted phishing, fraud, and identity theft as possible results of personal data leaks. Its guide also explains what people can do after a leak.
Customers of the photo lab should therefore stay careful with unexpected messages. This covers emails, text messages, and phone calls claiming to come from Incognito.fr or delivery firms. Customers should check any request through official contact channels. They should avoid clicking unfamiliar links. They should also avoid sharing more personal information.
CNIL, the French data protection authority, also shares advice on data leaks. Another CNIL page explains what to do after a data breach.
Cyberattack Claim Still Lacks Proof
Several key questions remain unanswered, and the hacker’s words are the main source so far. The hacker reportedly gave a sample and several file links. These materials do not show how the information was obtained.
No confirmed technical explanation names an exploited vulnerability, which is a weak spot in software. No report points to a compromised account, which is an account that someone else controls. Nothing shows unauthorized entry into the company’s systems, which means getting in without permission.
No independently confirmed statement from Incognito.fr explains the authenticity, scope, or circumstances of the claim. So nobody can say whether the data is real, how big it is, or how it got out. The claim therefore rests on the hacker’s word alone for now.
A database with a company’s name is not proof of a breach by itself. The records might be old. They might come from another source. The dataset might also carry the wrong company’s name. None of these options can be ruled out.
For now, the claim about nearly 15,000 Incognito.fr customers remains an unverified leak claim. The company or the relevant authorities must confirm whether customer information was compromised.
