Cat owners' data from France's I-CAD database ends up in the wrong hands: what happened and how not to fall for scammers

What happened

On 18 October 2026 an advert appeared on a cybercrime forum: a hacker going by the name ChimeraZ was offering to sell data from I-CAD — the national database in which dogs, cats and ferrets are registered in France. On 19 October French media reported it, citing FrenchBreaches, a website that tracks data leaks.

Three days later, on 22 October, France's Ministry of Agriculture issued an official statement. It confirmed the incident but described it far more calmly than the first reports.

What the hacker claimed

According to specialist websites, the hacker claimed to have almost 2.95 million rows: 2,898,001 records on animals and 50,629 records on vets. Analysts who received samples described the animal records as follows: microchip number, cat's name, date of birth, sex, whether it is neutered and the owner's name. According to them, the samples did not contain owners' contact details — addresses, phone numbers or email. The records included cats born before July 2026, and notes of animals' deaths up to 24 September 2026.

The vet records, in the view of the same analysts, came not from I-CAD but from other sources.

What the ministry confirmed

The ministry explained how it happened. The outsider used a user account issued to LOOF — France's official pedigree cat registry. LOOF keeps the stud book for pedigree cats and is entitled to view part of the I-CAD data needed to register cats. It was this access that was abused: it was used to download information about cat owners. LOOF is an organisation of breeders and pedigree cat enthusiasts: it keeps pedigrees, registers litters and issues pedigree certificates, and to do so it checks details against the national database.

The database operator, Ingenium Animalis, learned of the incident on 18 October, immediately shut that access, launched an investigation and tightened controls. According to the ministry, no other cases of unauthorised access have been found so far.

Whose data is affected and whose isn't

According to the ministry:

• affected: the first names and surnames of cat owners and the identification details of their animals;
• not affected: bank details, passwords, postal addresses, email addresses and phone numbers;
• not affected: data on owners of dogs and ferrets;
• no access found to data on vets — contrary to the first media reports.

No access to data relating to veterinarians has been found.

French Ministry of Agriculture, 22 October 2026

What I-CAD is and what it is for

I-CAD is France's national pet identification file. It is run on behalf of the Ministry of Agriculture by Ingenium Animalis. The database links an animal's microchip or tattoo number to its owner's details. It is used by owners, vets, rescue centres, local authority pounds for stray animals and professionals in the sector.

Its main job is to get lost pets back home: using the microchip number, a vet or rescue centre can quickly find the owner. In France identification is compulsory for dogs over four months old and cats over seven months old, so the database holds millions of records. The more data it holds, the more attractive it is to criminals.

This is not the first incident involving I-CAD. In September 2025 the operator reported a vulnerability through which some records could be requested automatically, and said it had fixed it and stepped up monitoring of the system. In August 2026 I-CAD warned owners about scam messages containing their personal details — possibly linked to the previous year's incident. The operator does not rule out a link with the current leak, although the methods were different.

Why this is a risk for cat owners

An owner's name and a cat's name are not secrets in themselves. The danger is that a scammer who knows your name and your cat's name, when it was born and its microchip number can write a very convincing message. Messages like these look genuine: they include your name, your pet's name and a link to an "official" website.

Typical scams of this kind:

• "your microchip registration urgently needs renewing or updating" — with a small payment via a link;
• "a fine has been issued for your animal" or "documents are missing";
• "we've found your cat" — with a request to pay for transport or a reward;
• "confirm your card details to receive a refund".

The aim is almost always the same — to get your bank card details or make you transfer money.

Sometimes scammers don't write but call. They pose as staff from the registry, the veterinary service or your bank, mention your name and your cat's name to win your trust, and ask you to read out a code from a text message or your card details. The number on your screen may look genuine — it is easy to fake. Real registry and bank staff never ask for codes from text messages.

How to spot a scam email or text

• You are being rushed: "urgent", "today is the last day", "or you'll be fined".
• You are asked to pay for something via a link or to send card details.
• The sender's address or the link doesn't match the official website, even if only one letter is different.
• The text has mistakes, odd wording or unfamiliar formatting.
• The message arrives even though you haven't changed anything in your pet's registration.

The ministry gives three simple pieces of advice: be wary of emails and texts asking for payment or personal details, check the sender's address and never send bank details in response to an unverified request.

What cat owners should do right now

1. Only go to the register yourself — by typing in the official website address, not by following a link in an email.
2. Check your record: are your phone number and address up to date? If your cat goes missing, that's how you'll be found.
3. Don't call back numbers from suspicious messages.
4. Turn on bank alerts for every card transaction — you'll spot a payment that isn't yours straight away.
5. Warn family and friends, especially older relatives who also have cats.
6. Don't post on social media your pet's microchip number or photos of its passport and documents — they are unnecessary clues for scammers.

These rules don't only apply in France: in the UK, where microchipping is compulsory for dogs and, in England, for cats, owners should be just as careful with messages about "microchip problems".

If you have already replied to scammers

If you clicked a link and entered your card details, call your bank immediately and block the card — that is the most important thing. Change your passwords if you entered them on a suspicious site. In France fraud can be reported to the police or gendarmerie, and phishing messages to the government platform for tackling cyber threats; in the UK, report fraud to the police or Action Fraud and forward scam texts to 7726. Keep screenshots of the emails and texts: your bank and the police will need them. If you read out a text message code to anyone, tell your bank specifically: such a code can be used to approve a payment or link your card to someone else's phone.

What data protection law says

Under the EU General Data Protection Regulation, an organisation that suffers a data breach must report it to the national regulator within 72 hours. In France this is the CNIL — the I-CAD operator notified it on 19 October. The national cyber security agency, ANSSI, is also aware of the incident. If a breach creates a high risk for the people affected, they must be informed individually. The regulator can check whether data is adequately protected and require better security.

Why you shouldn't give up on microchipping

After news like this, some owners wonder whether a microchip is needed at all. It is. In France identification of dogs and cats is required by law, and a microchip registered in a database is the best chance of getting an animal back if it gets lost, runs away or is taken to a vet after an accident. The leak concerned data, not the microchips themselves: a chip cannot be reprogrammed or "stolen".

A microchip is a tiny capsule the size of a grain of rice that a vet places under the skin. It has no battery and no GPS: it stores only a 15-digit number, which a scanner reads from a few centimetres away. A microchip cannot be used to find a cat in the street or track its movements. So even if a chip number has fallen into the wrong hands, the cat itself is not put in danger.

What happens next

The investigation is continuing, and the ministry has promised to report any further cases of unauthorised access. Cat owners in France should be especially alert in the coming months to any messages about "registration problems" — scammers often exploit leaks like this not straight away but later, once the story has been forgotten. If you have a dog rather than a cat, according to the ministry its data was not affected by the incident, but the same caution with emails and texts applies to all pet owners.