Threat watch / Breach
Effy: a partner craftsman's login used to read customers' renovation projects
Effy, a French energy renovation platform, told customers by email, relayed on November 11, 2026, that a third party logged into its partner space with the credentials of a partner craftsman, Airtech, and accessed the details of people put in touch with that company. Effy says its own systems were not hacked and that the credentials were "vraisemblablement" (probably) taken from the internet after a professional's computer was hacked or spyware was installed. It cut the access, reset the accounts' credentials and notified the CNIL.
- Sector
- Consumer apps & devices
- Way in
- Stolen credentials
- Product or vendor
- None named
- How it happened
- A third party signed in to the Effy Pro partner space with the login credentials of partner craftsman Airtech. Effy says no flaw or password leak was found on its platform and that the credentials were probably picked up online after a professional's computer was hacked or spyware was installed; that origin is not confirmed. The date and length of the access are not public.[1][2] Checked 12 Nov 2026
- What was stolen
- Title, first and last name, home and worksite address, phone number, email address, the kind of works planned and availability slots. Effy says no bank data was accessed. Whether the data was copied or only viewed is not stated.[1][2] Checked 12 Nov 2026
- Who was impacted
- People who submitted a renovation project and had been put in touch with Airtech. Effy has not given a number; they were informed by email.[1][2] Checked 12 Nov 2026
- Threat actor
- Not attributed