www.it-connect.fr
I-CAD Data Leak: 2.9 Million Cat Records Stolen With Owners’ Names
A cybercriminal managed to access the national I-CAD file, allowing them to extract 2.9 million data records. Following this security incident, your personal data and your cat’s data are now on a cybercriminal forum. Here is what we know.
As a reminder, I-CAD is the national identification database for dogs, cats, and ferrets. Thanks to this file, it is possible to link an animal to its owner through the microchip number (or tattoo) association. It is managed by Ingenium animalis, under delegation from the Ministry of Agriculture.
On October 21, 2026, I-CAD published an information notice about a security incident that had reportedly been reported on October 18, 2026. The cause: "the fraudulent use of an access account assigned to the LOOF", we can read. The Livre Officiel des Origines Félines (LOOF) is authorized to consult certain data in the file for the registration of cats in the pedigree book. The next day, the Ministry of Agriculture published a press release that adds an important piece of information missing from I-CAD’s notice: a figure, namely 2.9 million records consulted.
These statements only confirm the claims of a hacker known as ChimeraZ. Indeed, on October 18, this hacker put a database up for sale on a cybercriminal forum, which they attribute to I-CAD. In fact, it was following the alert sent by this cybercriminal that I-CAD is said to have confirmed the incident.
What was leaked, and what was not
According to the two press releases, the information that may have been accessed includes the first and last names of cat owners, as well as information related to the identification of their animals. In other words, this data leak contains precise information about your pet: microchip number, animal name, date of birth, sex, neutering status, and even death status.
I-CAD and the Ministry of Agriculture say several categories of data are not affected:
- Contact details: no postal addresses, email addresses, or phone numbers.
- Access and payment: no passwords or banking details.
- Dog owners: they are excluded from the scope of this data leak.
- Veterinarians: ChimeraZ claims to hold a file containing around 50,000 veterinarians. Investigations show "no access to data relating to veterinarians", replies the ministry. On that point, there is therefore some doubt.
The remaining question is how many people were actually affected. The hacker claims 2.9 million distinct individuals, while the Ministry of Agriculture refers to records. If one record corresponds to one animal, a person with three cats appears three times. The true number of people affected therefore remains unknown.
A legitimate account, and that’s the problem
Let’s finish with the attack scenario, because it feels familiar. Indeed, the cybercriminal used a compromised legitimate account: intrusions carried out with stolen credentials bring back memories of recent incidents.... Sound familiar? All of this is to say that this data leak is not linked to the exploitation of a software vulnerability.
Once again, this incident highlights another issue: why can an account intended for registering cats in the pedigree book access millions of records? Enforcing consultation quotas could also have helped limit the damage. The press releases also do not say whether this account was protected by multi-factor authentication. If the hacker was able to steal a session cookie, then multi-factor authentication may have been bypassed, but that is only a hypothesis.
If you have a cat, or even several, be wary of emails or text messages you may receive in the coming weeks. From now on, a message that includes your name, your cat’s name, and its microchip number could be malicious.
