Threat watch / Breach
Garanka: customer data exfiltrated in a cyberattack
French company Garanka told its customers by email on November 9 that personal data was exfiltrated during a cyberattack. In October its website only said that systems had been isolated and email was down. The data may include names and contact details, heating system and service history details, and in isolated cases invoices and payment information. Garanka says no bank card data was taken, and that it filed a criminal complaint and notified the CNIL.
- Sector
- Consumer apps & devices
- Way in
- Not public yet
- Product or vendor
- None named
- How it happened
- A cyberattack, according to the company's email to customers. The date and the way the attackers got in are not given.[1] Checked 13 Nov 2026
- What was stolen
- Personal data that the company says was exfiltrated, which "could include" names and contact details, heating system information and service history; in isolated cases, invoices and payment information. Garanka says no bank card data was exfiltrated.[1][2] Checked 13 Nov 2026
- Who was impacted
- Garanka customers. The company gives no number of people affected.[1] Checked 13 Nov 2026
- Threat actor
- Not attributed
Timeline
- Garanka updates a page on its website: its systems have been isolated and email is unavailable. Data is not mentioned. [1]
- Customers receive an email saying personal data was exfiltrated during a cyberattack, that a criminal complaint was filed and that the CNIL was notified. [1]
- The Bonjour la fuite tracker lists the leak as confirmed: name, contact details, heating system, service provider, invoices and payment information. [2]