A client accuses us of causing the leak of their data: we need to prove where the attack came from.

In early October 2026, the Hauts-de-France Region announced a leak of personal data. It publicly named two providers: Atexo, which runs its grants platform, and Docaposte, which runs an aid card for secondary school pupils and apprentices.

According to the Region, the data of up to 515,000 people may have leaked from Atexo, and that of around 30,000 from Docaposte. Bank details may be involved. The platforms were taken offline (Techniques de l'Ingénieur (opens in a new tab)). The Region filed a complaint and stated that its own system had not been affected.

The same month, the Swedish data protection authority made public the fine it had imposed on a software subcontractor, Miljödata: around 160,000 euros. Its clients, two municipalities and a region, were in turn investigated (Leto (opens in a new tab)).

Being named is not the same as being guilty. In October 2025, Discord blamed its customer service provider, 5CA. 5CA replied that it had not been hacked and that the incident had happened outside its systems (SecurityWeek (opens in a new tab)).