Europe’s No.1 carpooling platform BlaBlaCar was breached, hackers claim

Hackers claim to sell 140 million BlaBlaCar user records, potentially putting passengers and drivers across the globe at risk of fraud.

The post appeared on a cybercrime forum stating that carpooling giant Bla Bla Car had been breached. A threat actor is offering for sale what they say is a database containing 140 million user records.

So far, the company has not confirmed the cyber incident. However, if the claims prove to be legitimate, it may have a broad impact on users across Europe and beyond.

Bla Bla Car is a French long-distance carpooling platform that connects drivers with passengers traveling the same route. The company operates in 21 countries across Europe and Latin America and says it has more than 100 million members, making it Europe's largest carpooling platform.

Sample includes password hashes and driver information

Along with the post, the attacker shared 43 sample records to back up their claims. Cybernews researchers reviewed the provided sample. From the provided information, it seems that the dataset may include a wide range of account information, such as:

• Bcrypt password hashes
• Email addresses
• Phone numbers
• Gender information
• Account status flags
• Device information, including operating system and app version
• Vehicle details, primarily car brands

The inclusion of vehicle information means the affected individual may be the driver who registered on the platform to provide a ride.

Researchers warned that the exposed personal information could be used in phishing campaigns or scam calls.

Because the dataset includes contact details and information about users' devices and vehicles, attackers may be able to craft more convincing phishing messages targeting affected individuals.

While the seller claims the database contains 140 million records, Cybernews researchers say the true scope of the alleged breach cannot yet be verified.

Exposed password hashes increase security risks

Apart from personal data that was allegedly exfiltrated and is at risk of exposure, the attacker may have exfiltrated bcrypt password hashes.

Although bcrypt password hashes are significantly more resistant to cracking than weaker hashing algorithms, they are not immune to attack. If threat actors successfully recover passwords from the hashes, this may put users at risk of account takeovers.

Reusing passwords across multiple platforms remains the key security issue, so if an attacker learns your password on one platform, they may use it on other platforms, affecting multiple accounts.

Users who reuse the same credentials across multiple services may become vulnerable to credential stuffing attacks, in which stolen usernames and passwords are automatically tested against other websites.

New or old data?

Some indicators raise doubts about whether the database is recent.

"I am a bit suspicious about how old this data is," Cybernews researchers said. “The most recent dates are around 2025. However, I did not see any more posts about this, nor any news channels talking about it before.”

That makes it difficult to determine whether BlaBlaCar suffered a new breach, or if previously stolen data is being recycled by cybercriminals.

Cybernews has reached out to the company for a comment. We will update the story once a response is received.

The alleged breach comes as BlaBlaCar is preparing a major international expansion, announcing plans to enter 20 new countries.

The move will expand the French company's presence from 21 to 41 markets across Europe, Latin America, Southeast Asia, and, for the first time, Africa.

In France alone, BlaBlaCar facilitated around 40,000 daily commuter trips in 2025.