Incident Overview

A threat actor going by bestdata claims to be selling a 1.2 million record dataset described as French FICOBA banking leads. FICOBA (Fichier des Comptes Bancaires et Assimilés) is France's national registry of bank accounts maintained by the French tax authority, which records every bank account opened in France along with the account holder's identity. If this dataset is genuinely sourced from or mirrors FICOBA data, it represents one of the most sensitive French financial datasets possible.

The listing names the following banks whose customers appear in the dataset: BNP Paribas, Societe Generale, Credit Lyonnais (LCL), Credit Agricole (multiple regional banks), Caisse d'Epargne, Credit Mutuel, CIC, Banque Populaire, AXA Banque, Boursorama, Revolut, Monabanq, Carrefour Banque, HSBC, Allianz Banque, BRED, BforBank, and many other regional institutions. The data fields per record are extensive:

• Identity: Full names, dates of birth, birth city and department, territory classification.
• Government Identifiers: Social security numbers and tax identifiers (SPI, the French tax reference number).
• Banking Details: IBANs, BIC/SWIFT codes, bank names, bank branch information, account types, and account nature.
• Contact Information: Phone numbers, email addresses, main addresses, and possible secondary addresses.
• Family Data: Relatives information including names and birthdates of family members.
• Credentials: Possible password fields are listed, though the scope of this field is unclear.

The sample record shows a structured format with distinct Identity, Contact, and Address sections, including a specific individual's name, date of birth, Paris arrondissement of birth, department number, territory, and phone number. The combination of IBANs, social security numbers, tax identifiers, and full identity details across 15+ banks makes this a complete financial identity theft package. An attacker with this data could initiate fraudulent SEPA transfers, file false tax returns, open accounts in victims' names, or conduct highly targeted social engineering against specific bank customers.