80% of People in France May Have Data for Sale on the Dark Web: Are You Affected?

Nearly 8 in 10 people in France may have personal information for sale on the dark web. Mass breaches, people-search sites such as BrixHub, and identity fraud are now part of the same story. Here is what the figures mean — including if you do not live in France — and the habits worth adopting now.

This article will also interest you: Access to business networks is for sale on the Dark Web

An unprecedented exposure in France

France is in a critical stretch for cybersecurity. According to General André Petillot, major general of the national gendarmerie, “about 80% of French people have their data for sale on the dark web, to a greater or lesser extent.” He said this on October 8 at the Rencontres stratégiques de la Méditerranée in Toulon. The remark describes a problem that now reaches most of the population in France.

A Surfshark study published in July 2026 ranks France first in Europe for data breaches, with 43.4 million compromised accounts in the first half of the year — an increase of more than 62% compared with the second half of 2025. Worldwide, France ranks second, behind the United States.

Does this apply if you are not French?

The 80% figure is about people in France. It does not mean that 80% of Americans, Britons, or Canadians appear in the same dumps. Two cases are worth separating.

• You have a tie to France. A French bank, phone carrier, online shop, employer, tax account, health record, or relatives who use public services such as CAF (the family-benefits agency) or France Travail (the public employment service). You can be inside this exposure even if you live abroad.
• You have no tie to France. This particular statistic is not about you. The market for stolen data is. The same Surfshark ranking puts the United States first in the world, ahead of France. Breach data is resold, then reused for phishing and identity fraud, in English-speaking countries too. The checks below travel. The French reporting desks do not: use the authority where you live.

Who is caught in the French leaks?

Inside France, almost anyone can be. The exposed records come from very different sources:

• Public bodies. CAF suffered a leak affecting 1.2 million beneficiaries. France Travail and other administrations have also been targeted.
• Private companies. Retail sites, telecom operators, online services.
• Healthcare providers. Sensitive medical data is circulating as well.

What is for sale runs from a first and last name to highly sensitive records: postal address, phone number, email, social security number, carte Vitale number (the French national health-insurance card), and sometimes bank details. As General Petillot summed it up, “for some people, everything is there.”

BrixHub, the site that raised the alarm

Among recent revelations, BrixHub stands out. This search engine, open to the general public, claims access to more than 11 billion records drawn from data leaks that were already made public. It lets someone look up personal information — name, address, phone — and even offers a paid service to have those records removed.

Anne Le Hénanff, the junior minister for digital affairs, has said the courts were seized over BrixHub’s activities. France’s data protection authority, the CNIL, formally advises people not to use this kind of site. The sites themselves can put privacy at further risk.

Do not type your name, email, or phone number into a people-search built on stolen dumps, and do not pay a site to “delete” you from one. A removal fee does not pull data back from the rest of the market.

What can actually happen to victims

Personal data offered for sale is not an abstract privacy issue. The practical consequences include:

• Targeted phishing. Scammers use real details so the fraudulent message looks familiar.
• Identity theft. Loans taken out, bank accounts opened, goods bought in your name.
• Bank fraud. Unauthorized debits from an IBAN or other account details.
• Fake loan files. General Petillot has explicitly mentioned this kind of fraud.

How to check whether you are affected

Start with your email, not with a dark-web search box.

• Everyone: Have I Been Pwned (haveibeenpwned.com). It tells you whether an email address appears in breaches that have already been catalogued. It does not search the dark web for you, and it does not sell deletion.
• If you have French accounts: Cybermalveillance.gouv.fr, the national platform for advice and diagnosis, and ID Protect, a French dark-web monitoring service offered free in three steps.
• If fraud has already started where you live: in the United States, report it at IdentityTheft.gov and consider a credit freeze with Equifax, Experian, and TransUnion. In the United Kingdom, report it to Action Fraud. Elsewhere, contact your bank and your local police.

A warning from the CNIL: the authority says it cannot confirm whether a given person appears in a leak, and it tells the public to distrust sites that claim they can — especially sites that then charge for removal. That warning is about people-search and “we will delete you” services. It is not a reason to skip Have I Been Pwned.

Habits that work wherever you live

1. A unique password for every account

This is the rule that matters most. When one password is reused and a database is stolen, attackers try it everywhere else. A password manager (Bitwarden, Dashlane, 1Password) generates and stores strong, unique passwords so you do not have to memorize them.

2. Turn on two-factor authentication

A second check at login — a temporary code, an authenticator app, or a physical key — still blocks access when the password is already known. Prefer an authenticator app (Google Authenticator, Authy) over SMS, which can be intercepted.

3. Treat post-breach messages as suspicious

A text or email that uses your real name, your address, or an organization you actually use is not automatically genuine. Criminals use leaked data to look credible. Never send bank details, a password, or a code you just received by SMS in reply to an unsolicited message.

4. Always open the official site yourself

To check a request, go to the service’s official website or app directly. Do not use the link in the message.

5. Watch the accounts that can move money or identity

• Bank accounts: review transactions and the list of parties allowed to debit you.
• Email: an unknown login or an unrequested password change is a signal to act.
• Government and benefits accounts: in France, that means taxes, CAF, and France Travail. Elsewhere, it means your tax agency and any benefits portal you actually use.

6. What to do when a leak is confirmed

• Change the passwords of the affected accounts immediately.
• Turn on two-factor authentication everywhere it is available.
• If the account is French, report the incident on cybermalveillance.gouv.fr. If you live elsewhere, use the reporting service in your own country.
• If someone has used your identity, file a police report and keep the evidence: screenshots, emails, letters. In France that report is filed at a police station or a gendarmerie. Abroad, file it with your local police.
• If fraudulent debits appear, call your bank the same day.

What to remember

The situation in France is serious. It is not a reason to treat every reader as a French resident, and it is not a reason to do nothing. If you have French accounts, use the French tools. If you do not, keep the same habits and report problems where you actually live. Cybersecurity starts with ordinary gestures, not with a specialist’s toolkit.

FAQ: French data on the dark web

Does the 80% figure apply if I do not live in France?

No. General André Petillot was speaking about people in France. You are in scope if you have French accounts, a French employer, or family using French public services. If you have no tie to France, the percentage is not about you, but the same resale of stolen data exists in other countries, including the United States, which ranks ahead of France.

How can I check whether my email was in a breach?

Use Have I Been Pwned. It checks known breach collections. It is not a dark-web people search. If you have French accounts, Cybermalveillance.gouv.fr is the official place for advice. The CNIL cannot confirm that a named person is inside a given leak.

Should I use BrixHub or pay to delete my data?

No. The CNIL advises against this type of site. BrixHub claims to search records from leaks that are already public and offers paid removal. Paying one site does not remove data from the rest of the market, and the French courts have been seized over its activities.

What should I do if my data was exposed?

Change the affected passwords, turn on two-factor authentication, and call your bank if money moved. In France, report the case on cybermalveillance.gouv.fr and file a complaint if your identity was misused. Outside France, report identity theft to your local police and to the consumer authority where you live, such as IdentityTheft.gov in the United States or Action Fraud in the United Kingdom.