Science & Tech · Cybersecurity · 9 hrs ago
Data from 230,000 Strasbourg transport accounts stolen in cyberattack
The Strasbourg transport company CTS says data from about 230,000 customer accounts was stolen in a cyberattack.
The affected accounts represent about 40% of those registered on its website.
The stolen details include names, birth dates, addresses and account IDs, but not passwords or bank details.
The attack took place in the night of October 18 to 19, and CTS says it has stopped the data theft and fixed the security weakness.
The main remaining risk is scam emails that use the stolen details to seem genuine and trick people into sharing more information or money.
CTS has emailed affected customers and reported the breach to France’s data protection authority.
The company plans to file a complaint and urges customers to be cautious of messages claiming to come from CTS.
A cyberattack exposed data from about 230,000 customer accounts at Strasbourg’s public transport company, the CTS.
The affected information included names, dates of birth, addresses and account identifiers.
The CTS said bank details and passwords were not compromised.
The company said it stopped the data extraction after detecting it and strengthened the security of its website.
Affected customers were contacted and warned to watch for phishing messages.
- Who
- About 230,000 CTS customers.
- What
- Personal data from their accounts was stolen in a cyberattack. Bank details and passwords were not compromised.
- When
- The attack took place on the night of 18 to 19 October 2026. The CTS announced it on 28 October.
- Where
- The CTS website in Strasbourg, France.
- Why
- The attackers used the website illicitly to extract data. Their motive is not stated.
This story does not have two clearly opposing sides.
The attack took place, according to the CTS director, and used an API to extract data.
The CTS said it stopped the extraction and corrected the vulnerability.
The CTS announced the data theft and contacted affected customers.
- Affected accounts
- About 230,000
- Share of accounts
- About 40%
- Data exposed
- Names, dates of birth, addresses and account identifiers
- Data not exposed
- Bank details and passwords
- Regulator notified
- CNIL
- Planned legal action
- Complaint to the Strasbourg court
3 sources
What people are saying
I am really sorry for our customers but at worst they risk being bothered by unwanted emails
We are regularly victims of attacks, this time we were unable to thwart it
The bank details and passwords are not affected