I-run.fr data breach

The i-run.fr Domain Breach Exposure Report reveals a massive data incident affecting the French running and outdoor equipment retailer i-Run.

Key Details of the Breach

• Scale of Compromise: Nearly 592,980 to over 700,000+ client records were exposed during a leak on dark web forums. There were also claims of combolists noting hundreds of thousands of email and plaintext password pairs, however, this cannot be confirmed.

• Timeline: Activity and spikes in client compromises surged around June 2026.

• Malware & Infostealers: The incident involved infostealer activity and credential-harvesting malware families such as Acreed, Rhadamanthys, and LummaC2 targeting login and registration pages.

• Primary Region: The exposure is heavily concentrated in France and among international customers using the platform.

In order to start protecting yourself from possible fraud in future, we highly recommend the following steps:

1. Monitor your credit reports for possible suspicious activities. If you cannot do this yourself, we recommend you sign up with online services that does this on your behalf.

2. Be on the lookout for an increase in spam or fraudulent emails or phone calls. We recommend you install apps like True Caller on your phone to assist you in identifying possible spam or scam calls.

3. Change your password used in the affected website, but also any other website where you may have re-used the password.

4. Install Google or Microsoft's Authenticator app on your mobile device and activate 2FA authentication on any online service you use and which allow for this.