For a third of the price, it offered digital accounts for shopping or eating out. This is the tempting and dishonest method imagined by this student. This boy, aged 23, was arrested on Tuesday December 3, 2024 in a university residence in Marseille (Bouches-du-Rhône). He is suspected of having hacked the Pluxee company in Paris, Île-de-France and the provinces before selling, for a little less than a year, dematerialized payment vouchers on a Telegram channel.
The case dates back to last January when the company Pluxee, a subsidiary of Sodexo whose headquarters is in the 9th arrondissement of the capital, suffered a series of computer attacks. “The hacker is attacking its dematerialized meal voucher management application,” explains a source close to the case. The system allows employers to fund credit cards which are given to their employees to go out to eat at lunchtime, to go for sports or to make purchases. These plasticized keys can be used in a network of traders and restaurateurs.
Contacted this Thursday, the company which employs 750 employees and relies on 240,000 partner merchants does not wish to reveal its damage. She specifies that “safety, in all its forms, is a priority. And added that it “implements all necessary measures to ensure the confidentiality of data, the integrity of systems, and to protect the information of its customers and beneficiaries”.
-The police learned when the victim filed a complaint that 4,000 user accounts were compromised during the cyberattack. So many small amounts paid by employers to their employees' cards. The 2.0 scammer resells them at a third of their value on a Telegram channel which has the same name as the Parisian company. “For example, it was possible to buy the equivalent of 100 euros for 33 euros,” explains a source close to the matter.
Officials from BL2C, the cybercrime department of the Paris judicial police, follow the trail left by the account administrator. They identify the young suspect who allegedly acted alone. This geek, unknown to the police, is placed in police custody in the PJ premises for “fraud and entry into an automated data processing system”. During the hearings, the alleged scammer admitted the facts in full. “He sought to minimize his profits, which could reach hundreds of thousands of euros,” explains a source close to the case. During the searches no valuable property and no money were seized. He was released and will be summoned to appear in court next January.
