EN PT-BR
← Voltar ao feed
high facilities_maintenance real_estate

ChimeraZ claims leak of ADEMS14 heating-maintenance database: 100,826 records on 36,628 people

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 16:57 · coletado há 1 hora

ChimeraZ, an actor using that handle, has advertised a leak of a database linked to ADEMS14, a heating, air-conditioning and technical maintenance company based in Carpiquet, near Caen (cyberattaque.org). The listing claims 100,826 records for 36,628 people in about 67 MB of JSONL, split across intervention, housing and site datasets. Dark Web Informer has not verified the source, the counts, the size or whether the data is still on offer, and the actor does not explain how the data was obtained. Cyberattaque.org says it obtained the files and found them consistent with an export from a maintenance management application, but as of 9 November 2026 ADEMS had made no public statement confirming a compromise (cyberattaque.org). If authentic, the data would let criminals link named residents to addresses, service histories and building access notes, which supports convincing fake-technician scams and physical reconnaissance of homes.

Detalhes técnicos

  • The claimed material is organised as three JSONL files: about 54K intervention records, 43K housing (logements) records and 2K site records, with service dates, statuses, appointment metadata, names, email and phone fields, postal addresses and heating-type fields. Download mirrors are advertised but are not reproduced here.
  • Cyberattaque.org counted 43,680 housing records, 54,272 intervention records and 2,088 site records, plus 156 technician profiles, 20 client organisation records, 69 appliance references, software activity logs and 43 internal user accounts holding login identifiers and bcrypt password hashes, with no cleartext password found (cyberattaque.org).
  • Nearly 20,000 housing records carry a field for building access instructions, most interventions date from 2024 and 2025, and some records go back to 2014 or were edited until June 2026 (cyberattaque.org).
  • The collection method is unknown. The file structure suggests an export of several tables from a maintenance application after a compromise of the application, its administration or its database, but this is not established (cyberattaque.org).
  • Collection is mapped to T1213.006 (Data from Information Repositories: Databases) as an inferred technique, not a confirmed one.

Remediação

  • ADEMS and its clients should check whether the maintenance application and its database were accessed without authorisation, preserve logs and export history, and review administrative access.
  • Reset passwords for all internal accounts, revoke active sessions and rotate credentials used by integrations, since weak passwords behind bcrypt hashes can still be attacked offline.
  • If ADEMS is the data controller and the breach is confirmed, GDPR notification duties apply, including the 72-hour window to notify the CNIL. Property-management clients whose housing records appear in the data should be informed.
  • Residents and property managers should expect calls or visits from people posing as technicians. Verify identity by calling the company on a number taken from its official website or an existing contract, not one given by the caller, and do not give building access codes to unannounced visitors.

Relatos divergentes

  • Dark Web Informer describes the counts and availability as unverified and uses approximate figures (43K housing, 54K interventions). Cyberattaque.org reports having obtained the files, counted 43,680 housing and 54,272 intervention records, and found that the 36,628-person figure could not be confirmed exactly (cyberattaque.org). The file-based count is the more detailed of the two. Neither source confirms that the data is authentic or how it was obtained.

Linha do tempo

  1. darkwebinformer.com ↗ · pub. 09/11/2026 16:57 · coletado 09/11 18:00 primeiro registro

    ChimeraZ claims leak of ADEMS14 heating-maintenance database: 100,826 records on 36,628 people

    ler a análise desta fonte

    ChimeraZ, an actor using that handle, has advertised a leak of a database linked to ADEMS14, a heating, air-conditioning and technical maintenance company based in Carpiquet, near Caen (cyberattaque.org). The listing claims 100,826 records for 36,628 people in about 67 MB of JSONL, split across intervention, housing and site datasets. Dark Web Informer has not verified the source, the counts, the size or whether the data is still on offer, and the actor does not explain how the data was obtained. Cyberattaque.org says it obtained the files and found them consistent with an export from a maintenance management application, but as of 9 November 2026 ADEMS had made no public statement confirming a compromise (cyberattaque.org). If authentic, the data would let criminals link named residents to addresses, service histories and building access notes, which supports convincing fake-technician scams and physical reconnaissance of homes.

    Technical Details

    • The claimed material is organised as three JSONL files: about 54K intervention records, 43K housing (logements) records and 2K site records, with service dates, statuses, appointment metadata, names, email and phone fields, postal addresses and heating-type fields. Download mirrors are advertised but are not reproduced here.
    • Cyberattaque.org counted 43,680 housing records, 54,272 intervention records and 2,088 site records, plus 156 technician profiles, 20 client organisation records, 69 appliance references, software activity logs and 43 internal user accounts holding login identifiers and bcrypt password hashes, with no cleartext password found (cyberattaque.org).
    • Nearly 20,000 housing records carry a field for building access instructions, most interventions date from 2024 and 2025, and some records go back to 2014 or were edited until June 2026 (cyberattaque.org).
    • The collection method is unknown. The file structure suggests an export of several tables from a maintenance application after a compromise of the application, its administration or its database, but this is not established (cyberattaque.org).
    • Collection is mapped to T1213.006 (Data from Information Repositories: Databases) as an inferred technique, not a confirmed one.

    Remediation

    • ADEMS and its clients should check whether the maintenance application and its database were accessed without authorisation, preserve logs and export history, and review administrative access.
    • Reset passwords for all internal accounts, revoke active sessions and rotate credentials used by integrations, since weak passwords behind bcrypt hashes can still be attacked offline.
    • If ADEMS is the data controller and the breach is confirmed, GDPR notification duties apply, including the 72-hour window to notify the CNIL. Property-management clients whose housing records appear in the data should be informed.
    • Residents and property managers should expect calls or visits from people posing as technicians. Verify identity by calling the company on a number taken from its official website or an existing contract, not one given by the caller, and do not give building access codes to unannounced visitors.

    Conflicting Reports

    • Dark Web Informer describes the counts and availability as unverified and uses approximate figures (43K housing, 54K interventions). Cyberattaque.org reports having obtained the files, counted 43,680 housing and 54,272 intervention records, and found that the 36,628-person figure could not be confirmed exactly (cyberattaque.org). The file-based count is the more detailed of the two. Neither source confirms that the data is authentic or how it was obtained.