Threat watch / Breach
OFB (France): hunting licence exam portal flaw exposes data of 1,000+ people
CERT-FR's October REACTIV status report, published on November 12, 2026, says that on October 4, 2026 an IDOR flaw in the payment API of permischasser.ofb.fr, the French Biodiversity Office's portal for registering for the hunting licence exam, exposed personal data of more than 1,000 people, including minors. The data was published openly the same day. The site was taken offline that evening and came back during October after the flaws were fixed.
- Sector
- Government & politics
- Way in
- Software flaw
- Product or vendor
- None named
- people whose personal data was exposed, including minors[1]
- 1,000+
- How it happened
- An IDOR (insecure direct object reference) in the payment API of the public permischasser.ofb.fr portal, according to CERT-FR.[1] Checked 14 Nov 2026
- What was stolen
- Personal data of the registrants, published openly on October 4, 2026. The report does not list the data fields.[1] Checked 14 Nov 2026
- Who was impacted
- More than 1,000 people registered for the hunting licence exam, including minors. They were informed individually with a vigilance message.[1] Checked 14 Nov 2026
- Threat actor
- Not attributed
Timeline
- An IDOR in the payment API of permischasser.ofb.fr exposes data of more than 1,000 people, published openly the same day. The application is taken offline that evening, according to CERT-FR. [1]
- CERT-FR's October REACTIV status report says users were informed individually and the site came back online during October 2026 after the flaws were fixed. [1]