I-CAD Data Breach: What 2.9 Million French Cat Owners Should Know

In short: France's national pet ID database, I-CAD, says a third party fraudulently used an account belonging to the cat pedigree registry LOOF to view an estimated 2.9 million records containing cat owners' names and their animals' identification details, according to the French Ministry of Agriculture. Bank details, passwords, addresses, emails, phone numbers, dog owners and veterinarians were not accessed, the ministry says, correcting earlier reports. A breach notification was sent to France's data regulator, CNIL, on 19 October 2026.

If you have ever registered a cat's microchip in France, your name may now sit in a dataset a stranger wasn't supposed to see. Here's what the government and I-CAD have confirmed, what's still unverified, and what to do about it.

What is the I-CAD data breach and how many people were affected?

I-CAD is the French national file for identifying dogs, cats and ferrets. The Ministry of Agriculture says an unauthorized third party used a legitimate access account assigned to LOOF — the Livre Officiel des Origines Félines, the body authorized to consult certain I-CAD data for registering cats' pedigrees — to view records. The ministry's statement reads: "L'utilisation de ce compte a permis à un tiers non autorisé de consulter un volume de données estimé à 2,9 millions d'enregistrements," in English: use of the account allowed an unauthorized third party to view data estimated at 2.9 million records, per the ministry's notice.

That figure is "records," not "people." Cybersecurity outlet IT-Connect notes that since one owner can register several cats, the exact number of individuals affected isn't known, since the ministry's wording covers records rather than distinct people.

What information about cat owners and cats was exposed?

The ministry says the data concerns cat owners' first and last names together with their animals' identification details: "Les informations susceptibles d'avoir été consultées concernent des détenteurs de chats et comprennent leurs noms et prénoms ainsi que les informations relatives à l'identification de leurs animaux," per the ministry's statement — in short, owners' names plus their cats' ID data. IT-Connect's reading of the two official statements describes that identification data as potentially including a microchip number, the animal's name, date of birth, sex, neutering status and even death, per its report.

What was NOT exposed in the I-CAD breach?

Both the ministry and I-CAD are specific about what the hijacked account did not reach. The ministry's statement says: "Les coordonnées bancaires, mots de passe, coordonnées postales, adresses électroniques et numéros de téléphone ne sont pas concernés" — bank details, passwords, postal addresses, emails and phone numbers are excluded — and adds that dog owners' data is excluded entirely. It also corrects earlier coverage directly: "Contrairement à certaines informations publiées à propos de cet incident, les investigations ne font apparaître aucun accès à des données relatives aux vétérinaires," meaning investigations found no access to veterinarians' data, according to the ministry's statement. I-CAD's own notice repeats the same exclusions in its breach notice.

How did the breach happen, and when?

I-CAD says it learned of the incident on 18 October 2026, caused by fraudulent use of the LOOF access account. Its notice states: "Le Fichier national d'identification des chiens, chats et furets (I-CAD) a été informé, le 18 octobre 2026, d'un incident de sécurité résultant de l'utilisation frauduleuse d'un compte d'accès attribué au LOOF," which translates as I-CAD being informed on 18 October 2026 of a security incident caused by fraudulent use of an account assigned to LOOF, per its official notice. Access was revoked and related services temporarily suspended to secure systems, I-CAD says. A breach notification went to CNIL on 19 October 2026, and ANSSI, France's cybersecurity agency, was informed, according to the ministry. IT-Connect notes this was a compromised legitimate account rather than a software flaw being exploited, per its analysis.

Who was behind the I-CAD breach?

Neither the ministry nor I-CAD has named who carried out the unauthorized access, and neither statement says the data was copied, sold or published elsewhere. IT-Connect reports that a hacker known as ChimeraZ put a database attributed to I-CAD up for sale on a cybercriminal forum on 18 October, and also claims to hold a file of about 50,000 veterinarians, which the ministry's findings contradict; those are the attacker's claims, not confirmed by I-CAD or the ministry, per its report.

What should affected cat owners do to stay safe?

The ministry's advice is to watch for suspicious emails or texts requesting payment or personal information, check the sender's address, and never send bank details in response to an unverified request, stated as: "Le ministère [...] recommande aux détenteurs de chats de rester attentifs à tout courriel ou SMS suspect [...] et de ne jamais transmettre de coordonnées bancaires en réponse à une sollicitation non vérifiée," per the ministry's statement. IT-Connect adds a specific warning: a message citing your name, your cat's name and its chip number could now be fraudulent where before it would have looked routine, per its coverage.

Checklist:

1. Treat any email or text referencing your name and your cat's name as potentially fraudulent, even if details look accurate.
2. Verify the sender's email address or phone number before clicking links or replying, especially messages claiming to be from a vet, pet insurer, or a "lost pet" tracker.
3. Never send bank details, card numbers or passwords in reply to an unsolicited message, per the ministry's guidance.
4. If a message asks for payment to "confirm" your cat's identification or release records, contact I-CAD or your vet directly through a number or site you already trust.
5. Watch for fake "lost pet" alerts using your cat's real microchip number or birth date to appear legitimate.
6. Check CNIL's public materials on spotting phishing and reacting to identity theft, part of its cybersecurity awareness guidance.
7. For broader steps after any data breach, see what to do after a data breach.
8. To see exactly what I-CAD holds on you and your cat, request your data from I-CAD.

How can I protect myself from scams targeting I-CAD breach victims?

Credit monitoring, common advice after US breaches, isn't relevant here since no financial data was exposed. The realistic risk is phishing and smishing built around a name-and-pet-ID pairing that now looks more convincing than usual. Under the GDPR, organizations must notify CNIL of a breach within 72 hours when there's a risk to people's rights, and must tell affected individuals directly if that risk is high, per CNIL's guidance. If you registered a cat in France, staying skeptical of unexpected messages mentioning your pet by name is, for now, the main defense.