Colorbox: actor ChimeraZ claims leak of 7.67 million rows of French automotive-paint customer, invoice and shipping data
An actor using the handle ChimeraZ claims to have leaked a database tied to Colorbox, a French online store selling automotive paint and body-repair products to professional garages. The post advertises 7,673,997 lines in about 2.2 GB of CSV files, including 87,787 phone numbers and 60,291 email addresses, across mailing-list, parcel, invoice, business-management, user-account and delivery-address records. The dataset, its source, the counts and its availability have not been independently verified. A French cybersecurity news site (cyberattaque.org, search excerpt) dates the listing to 9 November 2026, attributes the data to color-box.eu, and reports that Colorbox has not publicly confirmed any unauthorized access. If the data is authentic, the mix of contact details, delivery addresses and invoices could support targeted phishing, impersonation and business-email-compromise attempts against Colorbox customers and garages.
Detalhes técnicos
- Collection (T1213.006, inferred): the listing presents structured CSV exports from databases, but the supplied material does not say how the data was obtained or prove unauthorized access to Colorbox systems.
- Files named in the listing: 1M_mailing_liste.csv, 174K_colis.csv, 144K_facture.csv, 114K_manageo.csv, 16K_utilisateur.csv and 16K_utilisateur_livraison.csv. Multiple download mirrors are advertised; they are not reproduced here.
- Visible samples (per the article): customer names, addresses, phone numbers, email addresses, invoice values and shipping information. The article does not transcribe them.
- Prerequisites and vulnerability: none named. No CVE, product flaw or vendor advisory is linked to this claim.
Relatos divergentes
- The article does not list password data. The French excerpt (cyberattaque.org) says the files also include password fingerprints. This is a single unverified source, and neither version has been confirmed.
- Colorbox has published no statement on the claim in the sources read (cyberattaque.org, search excerpt). The vendor's account of the incident is therefore unknown.
Linha do tempo
-
Colorbox: actor ChimeraZ claims leak of 7.67 million rows of French automotive-paint customer, invoice and shipping data
ler a análise desta fonte ocultar
An actor using the handle ChimeraZ claims to have leaked a database tied to Colorbox, a French online store selling automotive paint and body-repair products to professional garages. The post advertises 7,673,997 lines in about 2.2 GB of CSV files, including 87,787 phone numbers and 60,291 email addresses, across mailing-list, parcel, invoice, business-management, user-account and delivery-address records. The dataset, its source, the counts and its availability have not been independently verified. A French cybersecurity news site (cyberattaque.org, search excerpt) dates the listing to 9 November 2026, attributes the data to color-box.eu, and reports that Colorbox has not publicly confirmed any unauthorized access. If the data is authentic, the mix of contact details, delivery addresses and invoices could support targeted phishing, impersonation and business-email-compromise attempts against Colorbox customers and garages.
Technical Details
- Collection (T1213.006, inferred): the listing presents structured CSV exports from databases, but the supplied material does not say how the data was obtained or prove unauthorized access to Colorbox systems.
- Files named in the listing: 1M_mailing_liste.csv, 174K_colis.csv, 144K_facture.csv, 114K_manageo.csv, 16K_utilisateur.csv and 16K_utilisateur_livraison.csv. Multiple download mirrors are advertised; they are not reproduced here.
- Visible samples (per the article): customer names, addresses, phone numbers, email addresses, invoice values and shipping information. The article does not transcribe them.
- Prerequisites and vulnerability: none named. No CVE, product flaw or vendor advisory is linked to this claim.
Conflicting Reports
- The article does not list password data. The French excerpt (cyberattaque.org) says the files also include password fingerprints. This is a single unverified source, and neither version has been confirmed.
- Colorbox has published no statement on the claim in the sources read (cyberattaque.org, search excerpt). The vendor's account of the incident is therefore unknown.