200 private links
The cluster is hosted by a small French hosting company. This indicates that European data protection regulations (GDPR) should apply. European law requires explicit user consent for collecting and storing personal data.
The open Elasticsearch server, accessible to anyone without authorization, stood out due to a massive index with a mysterious name, “vip-v3.” It contained 95,350,331 documents from at least 17 data breaches and had a total size of 30.1GB.
Company involved in the leak (from the txt files):
Lycamobile, darty, Pandabuy, discord, dvm, electro dépôt, Bins & Bières, Snapchat, FRS, Go Sport, Intersport, LDLC, Corse GSM, Pinterest, Minecraft FR (forum), SFR, Shadow (cloud computing service).
It also shares data from sport 2000, Wakanim and Rinaorc (minecraft server, or service using the AuthMe plugin).