AAMV Data Breach: 19,565 French Childcare Worker Accounts Exposed

French Childcare Worker Data Exposed: The AAMV Breach

AAMV served as a French community platform connecting childacre workers -- assistantes maternelles and other early childhood professionels -- in a professional support and networking environment. When 19,565 user accounts were exposed in an August 2018 database breach with MD5-hashed passwords entered combolist circulation, a specialized professional community found their credentials at risk on a platforme they had trusted with their professional identity.

AAMV (August 2018): Breach Summary

• Records Exposed: 19,565
• Data Types: Email addresses, password hashes
• Breach Type: Database breach / Combolist
• Password Hash Type: MD5 -- fast algorithm, no salt, rainbow table vulnerable
• Country Affected: France
• Date Leaked: August 24, 2018

Professional Community Platforms: A Distinct Risk Profile

AAMV's user base was not a general consumer audience -- it was a professional community of childcare workers who registered accounts to access peer support, resources, and networking specific to their sector. Professional community platforms often carry more consistent and reliable email addresses than general consumer sites -- users are more likely to have registered with their real, active professional email address rather than a throwaway account.

This increases the reliability and targeting precision of the exposed dataset for phishing campaigns. A threat actor who knows an email belongs to a French childcare professional can craft highly specific social engineering messages referencing sector-specific topics.

French Data Protection Context: GDPR Enforcement in 2018

The AAMV breach occurred in August 2018 -- after GDPR took effect on May 25, 2018. France's Commission nationale de l'informatique et des libertés (CNIL) was well established as a data protection authority by this point and had significant enforcement history predating GDPR. Under GDPR, a breach exposing 19,565 professional community accounts with inadequately protected passwords triggers mandatory reporting and potential investigation.

French professional community platforms operating in childcare-adjacent sectors carry implicit trust obligations to their users. MD5 password storage without salting does not meet the technical security standard expected of platforms handling professional identity data.

MD5 Hashing and Combolist Exposure: The Ongoing Risk

AAMV stored passwords using MD5 without salt -- the same weak configuration seen across many 2018-era database breaches. Rainbow table attacks against unsalted MD5 can recover common passwords in milliseconds, and the entire 19,565-record dataset was subsequently incorporated into broader combolists. Credential stuffing tools drawing from these combolists continuously test the exposed email/password pairs against other platforms.

For AAMV users who have not updated their credentials since 2018 -- particularly those who reused the same password on email or other professional accounts -- the breach represents an ongoing, unresolved exposure.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to determine whether your email address appears in known data breaches, including the AAMV combolist. Run a free scan at HEROIC.com to identify any ongoing credential exposure.