Hacker's claimed 11,000-record leak from France's AMF looks like public data, analysis finds

A hacker operating under the alias ChimeraZ has claimed to have obtained and published more than 11,000 records tied to the domain of the Autorité des marchés financiers (AMF), France's securities regulator. The claim surfaced in a forum post titled "[FR] 11K AMF-FRANCE.ORG", referencing a file of roughly 49 megabytes containing 11,173 records.

Cybersecurity outlet FrenchBreaches examined the claim and, in a report published Friday, October 30, found no evidence that the AMF's own systems had been breached. According to the outlet, the sample it reviewed consists largely of data already accessible through the regulator's public channels.

What the sample contains

The material examined by FrenchBreaches references the fund FORTITUDE, managed by SOGELYM DIXENCE INVESTMENT MANAGEMENT, with CACEIS Bank listed as depositary. Beyond these names, the sample includes denominations, regulatory references, headquarters addresses, entity identifiers and update dates — the kind of administrative information typically attached to registered investment vehicles and management companies.

FrenchBreaches reported finding no passwords, no personal banking details and no balances or transaction records belonging to individual investors anywhere in the data it reviewed.

One detail pointed to by the outlet is a technical field within the leaked data carrying the mention "affichageGeco". GECO is the AMF's own public consultation database covering collective investment products and management companies. Its interface already displays names, approval numbers, addresses and professional contact details for registered entities, and includes an export function specifically for management companies — the kind of feature that could plausibly generate a file resembling the one circulated by ChimeraZ.

A claim without confirmed intrusion

Taken together, the elements documented by FrenchBreaches point toward a dataset built from material the AMF already makes available to the public through GECO, rather than evidence of unauthorised access to the regulator's internal systems. The outlet's report does not establish how ChimeraZ compiled the file or whether any of it falls outside what GECO's export tool would normally return.

For now, the episode illustrates a recurring pattern in such claims: a headline figure of thousands of "stolen" records that, on closer inspection, overlaps substantially with information a regulator has chosen to publish itself for transparency purposes. No confirmation of an actual compromise of the AMF's infrastructure has been established.