Short answer
CTS, the public transport operator of Strasbourg, said on 28 October 2026 that data from about 230,000 customer accounts was taken through its website. It says passwords and bank details were not exfiltrated, the flaw is fixed, and it has told the CNIL.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | CTS (Compagnie des Transports Strasbourgeois) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Public transport |
| Country | France |
| Disclosed | 2026-10-28 |
| People or records affected | About 230,000 customer accounts, close to 40 percent of CTS accounts (accounts, not necessarily distinct people) |
What data was exposed
- Last name and first name
- Date of birth
- Postal address
- Badgeo account identifier
What happened
CTS, the Compagnie des Transports Strasbourgeois that runs Strasbourg’s trams and buses, announced on 28 October 2026 that data from about 230,000 customer accounts had been taken. Clubic dates the attack to the night of 18 to 19 October and says the figure is close to 40 percent of CTS customer accounts. Cyber-securite.fr notes that 230,000 may count accounts rather than distinct people.
How it happened, according to CTS
Clubic reports that the attackers used an API, the interface that lets software talk to the CTS website, to pull the data. CTS says its servers were not altered. It noticed unusually heavy requests on its database, stopped the exfiltration and closed the flaw. Cyber-securite.fr quotes CTS describing an “exfiltration linked to its website” and says security on the site has been strengthened.
What data was exposed
The exposed fields are last name, first name, date of birth, postal address and the Badgeo identifier tied to the account. CTS says passwords and bank details were not taken. Customers were told individually.
Clubic also notes that some customer accounts had already been accessed fraudulently two years ago. That is a separate matter, but it is a reason to avoid reusing a password.
What CTS has done
CTS has reported the incident to the CNIL, France’s data protection authority, and plans to file a complaint. Its director general, Emmanuel Auneau, apologized to customers. Whether the stolen data has been resold or leaked is not known.
Scam risks
Name, birth date and address make a phishing message look personal, and a Badgeo identifier gives a scammer something specific to quote. CTS warns about fake emails on a Badgeo subscription, a regularization or a refund, and says it never asks for payment or bank details by email. Our guides on phishing messages and government impersonation scams cover the fake fine and fake refund patterns, and what to do after a data breach lists the follow-up steps.
French residents can report phishing at signal-spam.fr and get free help at cybermalveillance.gouv.fr.
What is still unknown
CTS has not described how the API was misused beyond the above, and no group has claimed the data. We will update this page if CTS or the CNIL publishes more. See our editorial policy.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake emails about a Badgeo subscription, a regularization or a refund that link to a lookalike CTS page
- Messages asking you to pay a fine or fee for your transit account, or to confirm bank details
- Phishing that uses your real name, birth date and address to look personal
What to do if you are affected
- 01Do not click links in emails or texts about your CTS or Badgeo account. Open the CTS site yourself or use a contact you already know.
- 02CTS says it never asks for a payment or bank details by email. Treat any message that does as fake.
- 03Change your CTS password if you reuse it anywhere else, even though CTS says passwords were not taken.
- 04Keep suspicious messages without replying, and report phishing at signal-spam.fr or on cybermalveillance.gouv.fr.
- 05Watch for identity misuse and file a complaint if someone uses your details.
Frequently asked questions
Were passwords or bank details stolen in the CTS breach?
CTS says no, according to Clubic, which reports passwords and bank details were not taken. The exposed data is name, date of birth, postal address and the Badgeo identifier.
How did the attackers get the data?
Clubic reports they used an API connected to the CTS website. CTS says its servers were not altered, it spotted abnormal load on its database, stopped the exfiltration and fixed the flaw.
When did it happen?
Clubic dates the attack to the night of 18 to 19 October 2026. CTS announced it on 28 October.
Is the data being sold or published?
Unknown. CTS told Clubic it does not yet know whether the data has been resold or released.
Has CTS informed the authorities?
Yes. Both reports say CTS notified the CNIL, and Clubic adds that a complaint is to be filed with the Strasbourg court.
Sources
- Piratage a Strasbourg : les donnees de 230 000 clients de la CTS compromises, Clubic, 2026-10-29
- CTS Strasbourg : des donnees de 230 000 comptes clients compromises, Cyber-securite.fr, 2026-10-30
This post summarises public reporting as of 2026-11-05. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.