Ledil Immobilier (ledil.immo) Database Breached: Threat Actor 888 Leaks 6,700 French Real Estate User Records
Threat actor 888 leaks full database of French real estate firm Ledil Immobilier with 6,700 user records.
Summary
Threat actor 888 posted a complete database dump of Ledil Immobilier, a French real estate mandataire network, containing 6,700 user records including names, emails, phone numbers, addresses, and property transaction data. The data was distributed freely on the cybercrime forum darkforums.su, maximizing exposure and making containment impractical. The breach exposes high fraud risk against buyers, sellers, agents, notaires, and other transaction participants.
Full text
Active Threat Report ID: DWI-2026-0421-01 Critical Severity A full database dump of a French real estate network with 6,700 unique user records, including names, emails, phone numbers, addresses, property transaction data, and professional identifiers for notaires and mandataires. Distributed as a free download on darkforums.su, maximising exposure. High risk of targeted fraud against buyers, sellers, and agents. 01 Incident Summary Date & Time2026-04-21 19:24 UTC Threat Actor888 VictimLedil Immobilier (ledil.immo) IndustryReal Estate / Mandataire CategoryData Breach Unique Records6,700 Breach Date (claimed)April 2026 ScopeFull Database DistributionFree Download AccessForum Registration PlatformDrupal (Search API) Forumdarkforums.su NetworkOpen Web Country France 02 Incident Overview A threat actor going by 888 has posted the full database of Ledil Immobilier (ledil.immo) on a popular cybercrime forum. Ledil Immobilier is a French real estate mandataire network founded in 2012 by Katia and Laurent Baron in Agen (Lot-et-Garonne, Nouvelle-Aquitaine) and operating nationally with more than 2,000 property listings across houses, apartments, land, and investments. The actor describes the company as "a pioneering network of free real estate agents" and states the breach occurred in April 2026. According to the listing, the dataset contains 6,700 unique user records. The exposed schema visible in the compromised-data list and sample rows is consistent with a full export from Ledil's internal business tool, which appears to run on Drupal with the Search API (fields include search_api_solr, drupal_X2f_langcode, and entity:acquereur references). The data categories exposed include: Acquéreur (Buyer) RecordsFull names, email addresses, telephone numbers, addresses, nationalities, and search criteria tied to individual prospective buyers registered in Ledil's CRM. Mandataire & Agent DataAgent user IDs, names, emails, and telephone numbers for Ledil's network of mandataires, along with sector assignments and postal codes of their working zones. Notaire & Intervenant DetailsIdentifiers for notaires and other transaction intervenants, with linkages to specific property files and mandates. Property (Bien) RecordsProperty prices, descriptions, locations (commune, département), surface areas, legal statuses, number of rooms, energy categories, commercial status, and offer-type metadata. Transaction MetadataHonoraires (agent fees), mandate document numbers, boost and highlight flags, creation and update timestamps, message logs, and internal statuses for each listing. The sample rows published by the actor include real French email addresses across commonly-used domains (wanadoo.fr, hotmail.fr, and corporate addresses such as amann-kaffee.at), first names, and Drupal entity URLs pointing to enterprise1.ledil.immo, suggesting the leak originates from an internal staging or production instance of Ledil's mandataire platform rather than from a public website. Transaction timestamps in the visible sample cluster around late 2025, consistent with the claimed April 2026 breach date. The fact that the dataset is being distributed at no cost, only gated behind basic forum registration, maximises exposure and makes retroactive containment impractical. 03 Compromised Data Categories Full Names Email Addresses Telephone Numbers Home Addresses Nationalities Acquéreur Search Criteria Mandataire IDs Notaire Identifiers Property Prices Property Addresses Agent Fees (Honoraires) Mandate Numbers Transaction Timestamps Drupal Entity URLs 04 Screenshots FIG 01 · darkforums.su listing by 888 announcing the Ledil breach FIG 02 · Sample records: French emails, Drupal fields, enterprise1.ledil.immo URLs This post is for subscribers on the Plus, Pro and Elite tiers Subscribe Already have an account? Sign In
Indicators of Compromise
- domain — darkforums.su
- domain — ledil.immo
- domain — enterprise1.ledil.immo