- A group called ZeroBytes says it broke into Déclic Services and stole more than 6.2 million lines of data.
- The stolen files allegedly include IBAN numbers, emails, passwords, and other banking details.
- Déclic Services has not confirmed the breach, and none of the claims have been independently verified yet.
A cybercrime group named ZeroBytes claims it hacked into Déclic Services, a French company. The group posted its claim on a forum that criminals often use. It says it now holds a massive database and wants to sell it.
According to a post shared on X by researcher Seb (@seblatombe), ZeroBytes is the same group behind an earlier attack on DGFiP, a French tax agency. The group also changed the Déclic Services website to publish a sample of the stolen data. It accuses the company of failing to report the breach to CNIL, France’s data protection authority.
The Numbers Behind the Claim
ZeroBytes says the stolen database holds 6,271,531 lines. The group describes this number as raw and not cleaned up. That means duplicate entries were never removed. So the real number of people affected is likely much smaller.
The group also lists specific figures. It claims 6,451 unique IBAN numbers appear in the data. It also claims 14,947 unique email addresses and 561 unique passwords. Separately, ZeroBytes mentions around 13,000 users and roughly 6,300 IBAN records tied to the attack.
These numbers do not all match up cleanly. A single person or business can appear in more than one file. The mismatch shows why the total record count should not be read as a victim count.
ZeroBytes shared a sample of about 300 rows split across seven tables. The sample reportedly covers businesses, members, bank details, and payments made to URSSAF, France’s social security collection agency.
The group claims the full database includes more than 415 additional tables. These would allegedly hold invoices, contracts, user accounts, and internal documents. None of this has been confirmed outside the group’s own claims.
How ZeroBytes Says It Broke in
ZeroBytes shared a story of how it says the attack happened. It claims the break-in started through a WordPress site that anyone could reach online. From there, the group says it found an ERP system, a type of software companies use to manage daily operations, exposed on the internet.
Brazilian financial data has also been a target on underground forums. In April 2026, a threat actor advertised a dataset allegedly containing 2.3 million records tied to Brazil’s financial sector, including full names, email addresses, phone numbers, and account-related references. The seller claimed the data came from multiple banking institutions, but no verifiable sample was provided, and the claim remained unconfirmed.
The group claims it then exploited a flaw in that ERP system. This alleged flaw let it slip into the company’s main database without permission. ZeroBytes summed up its attack path in three steps: WordPress, then the ERP tool, then the database, and finally the company’s cloud storage.
The group also claims some of the company’s online services lacked proper login checks. It says weak network barriers made unauthorized access easier. This version of events comes only from the attackers. No outside party has confirmed any part of this chain actually took place.
Risks for Déclic Services Users
If the leaked data turns out to be real, the danger could reach far beyond Déclic Services itself. Scammers could combine names, emails, and banking details to build convincing phishing messages. Fake invoices sent to real customers could trick people into paying the wrong account.
Banking data raises a sharper concern. Criminals could use exposed IBAN numbers to attempt fraud tied to bank transfers. Business owners and subcontractors named in the data could face impersonation attempts too. Someone posing as a real supplier could request payment changes that seem legitimate.
Technical details in the claimed leak add another layer of risk. ZeroBytes says it also holds cloud access keys and internal server names. If real, these could let attackers reach other systems tied to the company. None of this has been proven, but the mix of personal, financial, and technical data makes the claim worth watching closely.
So far, Déclic Services has not issued a public statement. The exact scope of the breach, the number of real victims, and the technical details behind the attack all remain unconfirmed. Anyone connected to the company should still watch their bank accounts and stay alert for suspicious messages, just in case the claim proves true.
