At a glance: A purported dataset of 140 million BlaBlaCar users is being offered for sale on the darknet, but security researchers are uncertain whether it represents a new incident or older data being resold.
An unknown actor is offering a database containing 140 million user records from the rideshare platform BlaBlaCar for sale on a cybercrime forum. BlaBlaCar has not commented on the incident to date.
The seller has published a sample of 43 records that were analyzed by security researchers from Cybernews. The sample contains email addresses, phone numbers, Bcrypt-hashed passwords, account status, gender information, and device details such as operating system and app version. It also includes vehicle details of registered drivers.
The combination of these data types presents a significant abuse risk. Security researchers warn of targeted phishing attacks that could exploit contact information and vehicle details of those affected, as well as fraudulent calls based on personalized information. BlaBlaCar operates in 21 countries across Europe and Latin America and reports having over 100 million members.
It remains unclear whether this represents a current security breach or older data being circulated again. Analysis of the timestamps suggests the data may not stem from a recent breach. A Cybernews security researcher stated: “I am somewhat skeptical about how old this data is. The most recent dates are around 2025. However, I have not seen further posts about this and no news channels that reported on it previously.” An official statement or confirmation of the incident by BlaBlaCar has not yet been issued.
Source: www.it-daily.net · Published 22 July 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.