CTS Strasbourg Data Breach Exposes 230,000 Customer Accounts

The Compagnie des transports strasbourgeois (CTS), which runs buses and trams in the Strasbourg area, has confirmed a data breach affecting roughly 230,000 customer accounts, close to 40% of its users. The company says the exfiltration was made possible by the illicit use of its website.

What was stolen

The exposed data includes last name, first name, date of birth, postal address and customer ID. According to the CTS, bank details and passwords were not involved in the incident.

The attack took place overnight between Sunday, October 18 and Monday, October 19. CTS director Emmanuel Auneau said his teams noticed an unusually high number of requests to the company's database. Attackers exploited a vulnerable application programming interface (API), which lets software communicate with the CTS website. The company states that its servers were not altered and that the hackers did not infiltrate its IT system.

Response and risks

The CTS says it reacted as soon as the attack was detected: the exfiltration was stopped and security around the site was reinforced. The French data protection authority, the CNIL, has been notified, and a complaint will be filed with the Strasbourg court. It is not the first time the operator has been targeted, as it already recorded fraudulent access to some customer accounts in 2024.

Affected customers were notified by email this week. The main risk, the company explains, is phishing, since the stolen details can make fraudulent messages look more credible. The CTS stresses that it never asks customers to make a payment or send bank details by email. If in doubt, users should avoid clicking links and go directly to the official website or app.

The incident adds to a long list of French organizations hit by data leaks, including the tax authorities, several telecom operators and dozens of sports federations. A study by Cybermalveillance, France's cybersecurity assistance platform, suggests that nearly half of French people have been affected by a hack this year.