Data breach at Strasbourg's CTS: around 230,000 customer accounts affected. What the company must do, what to expect after a leak, and how to avoid phishing

What happened

On 28 October the Compagnie des transports strasbourgeois (CTS), which runs Strasbourg's trams and buses, announced a data breach. According to the company, data from about 230,000 customer accounts was extracted through unlawful use of its website — roughly four in ten of its approximately 586,000 accounts.

What was taken, according to CTS: surname and first name, date of birth, address and account identifiers. The company says bank details and passwords were not among them. CTS says it stopped the extraction as soon as it detected it, tightened security on its website, reported the incident to the CNIL, informed the customers concerned and intends to file a complaint. When the intrusion took place and how long it lasted has not been disclosed.

CTS itself warns customers to be wary of emails that claim to come from CTS and ask for any information, especially bank details.

Why "no bank details" does not mean "no risk"

A name, date of birth and address cannot empty a bank account on their own. But they make a fraudulent message more convincing: an email that greets someone by name and mentions their address is easier to trust. That is why CTS is asking people to treat emails in its name with suspicion.

What the rules require of the company

According to the CNIL's guidance on the GDPR (RGPD in French), an organisation that suffers a personal data breach:

• must notify the CNIL no later than 72 hours after becoming aware of it;
• if the risk to people is high, must tell those people directly as soon as possible;
• must explain in that message, in clear terms, what happened, the likely consequences, who to contact (the DPO or another contact) and what has been done to limit the damage — and, where needed, give recommendations such as changing passwords.

Worth remembering: a breach notice, as the CNIL describes it, explains and advises. It does not ask you to reply with your card number.

What CTS customers — and anyone after a leak — can do

Recommendations from Cybermalveillance.gouv.fr and the CNIL:

1. Do nothing with suspicious messages. Don't click links, don't open attachments, don't reply. If in doubt, contact the organisation yourself through a website you did not reach from the message (ideally from your own bookmark).
2. Check links and web addresses. Hover over a link without clicking; check the site address — a single changed character can give a fake away. Legitimate organisations do not ask for bank details or passwords by email or phone.
3. Passwords. The CNIL advises changing passwords, starting with the most important services, not reusing the same password across sites, and turning on multi-factor authentication where available.
4. Report fraud. Suspicious emails go to signal-spam.fr, suspicious text messages to 33700, fake websites to phishing-initiative.fr.

If you have already clicked or handed over data

According to Cybermalveillance.gouv.fr:

• if you gave card details or see debits you don't recognise, make an opposition with your bank immediately;
• change passwords on the affected site and wherever the same password was used; check the date of the last login to the account;
• keep evidence, above all the fraudulent message itself;
• file a complaint (plainte) at a police station or gendarmerie, or in writing to the public prosecutor; free victim support is available from France Victimes on 116 006 (daily, 9:00–19:00), and advice from Info Escroqueries on 0 805 805 817 (free, Monday–Friday, 9:00–18:30).

In cases of identity theft (usurpation d'identité), the CNIL advises filing a complaint as quickly as possible and, once the theft is confirmed, asking the CNIL for a check of the FICOBA register of bank accounts.

About compensation

The CNIL states plainly that it does not award compensation: claiming damages is a matter for the civil courts.

In short

The CTS breach is not a reason to panic, but it is a reason to pay closer attention to email and text messages for the next few weeks. Any message "from CTS", "from the bank" or "from a government body" asking to confirm details is best checked through the official website, opened independently.