Hackers claim Europe’s top carpooling platform, BlaBlaCar denies data breach
40,000 daily passengers’ data may be up for sale.
- Hackers claim to be selling 140 million BlaBlaCar user records.
- Cybernews researchers reviewed sample data showing emails, phone numbers, password hashes, device details, and some vehicle information.
- Researchers warn the data could help criminals run phishing scams, make scam calls, or target reused passwords on other sites.
- The claim comes as BlaBlaCar plans expansion from 21 to 41 markets.
Hackers are claiming to have 140 million BlaBlaCar user records up for sale, potentially putting passengers and drivers across the globe at risk of fraud.
The post appeared on a cybercrime forum stating that carpooling giant BlaBlaCar had been breached. A threat actor is offering for sale what they say is a database containing 140 million user records.
BlaBlaCar is a French long-distance carpooling platform that connects drivers with passengers traveling the same route. The company operates in 21 countries across Europe and Latin America and says it has more than 100 million members, making it Europe's largest carpooling platform.
Sample includes password hashes and driver information
Along with the post, the attacker shared 43 sample records to back up their claims, which Cybernews researchers have reviewed. From the provided information, it seems that the dataset may include a wide range of account information, such as:
- Bcrypt password hashes
- Email addresses
- Phone numbers
- Gender information
- Account status flags
- Device information, including operating system and app version
- Vehicle details, primarily car brands
The inclusion of vehicle information means the affected individual may be the driver who registered on the platform to provide a ride.
Our researchers warned that the exposed personal information could be used in phishing campaigns or scam calls.
Because the dataset includes contact details and information about users' devices and vehicles, attackers may be able to craft more convincing phishing messages targeting affected individuals.
While the seller claims the database contains 140 million records, Cybernews researchers say the true scope of the alleged breach cannot yet be verified.
Exposed password hashes increase security risks
Apart from personal data that was allegedly exfiltrated and is at risk of exposure, the attacker may also have exfiltrated bcrypt password hashes.
Although bcrypt password hashes are significantly more resistant to cracking than weaker hashing algorithms, they are not immune to attack. If threat actors successfully recover passwords from the hashes, this may put users at risk of account takeovers.
Reusing passwords across multiple platforms remains the key security issue: if an attacker learns your password on one platform, they may use it on others, affecting multiple accounts.
Users who reuse the same credentials across multiple services may become vulnerable to credential stuffing attacks, in which stolen usernames and passwords are automatically tested against other websites.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
New or old data?
Some indicators raise doubts about whether the database is recent.
"I am a bit suspicious about how old this data is," one of our researchers said.
“The most recent dates are around 2025. However, I did not see any more posts about this, nor any news channels talking about it before.”
That makes it difficult to determine whether BlaBlaCar suffered a new breach, or if previously stolen data is being recycled by cybercriminals.
The alleged breach comes as BlaBlaCar is preparing a major international expansion, announcing plans to enter 20 new countries.
The move will expand the French company's presence from 21 to 41 markets across Europe, Latin America, Southeast Asia, and, for the first time, Africa.
In France alone, BlaBlaCar facilitated around 40,000 daily commuter trips in 2025.
BlaBlaCar denies data breach
Cybernews has reached to BlaBlaCar for a comment on the incident. The company's spokesperson told reporters, that the data present in the listing is has not originated from BlaBlaCar systemd.
"Following allegations of a data breach, our cybersecurity team conducted a thorough investigation into the claims and the sample data provided.
We can confirm that the published data does not come from BlaBlaCar's systems or database," the spokesperson said.
"The security and privacy of our platform and user data remain our top priority," they added.
Updated on July 23th [13:20 p.m. GMT+2] with a statement from BlaBlaCar.