Unknown actors have breached the infrastructure of the prominent Francophone torrent tracker YggTorrent, declaring a complete extraction of its data and publishing a damning manifesto directed at the administration. The architects of this assault assert that they have dismantled the project’s servers while meticulously preserving the entirety of the site’s torrent distributions.
According to the infiltrators, the entire YGG torrent catalog has been successfully cloned. This exhaustive archive was subsequently handed over to the U2P project collective, who have already established a provisional tracker at the domain ygg.gratis. Although the service currently experiences instability owing to a massive influx of visitors, the developers are working tirelessly to restore unfettered access to the distributions.
The assailants proclaimed that the tracker boasted a user base of approximately 6.6 million, generating revenues approaching 10 million euros between 2024 and 2025. This wealth was primarily amassed through the premium “Turbo” tier, a mechanism designed to bypass download restrictions. Without this subscription, patrons were strictly limited to downloading a mere five files per day. Within their published manifesto, the hackers contend that the administration ruthlessly exploited the site’s monopolistic dominance, effectively coercing the community into paying.
The dispatch furthermore enumerates the purported administrators governing the service. The hackers identify “Francisco,” who allegedly operates from Morocco, alongside “Vladimir” from France. An individual operating under the pseudonym “Oracle” is also explicitly cited. The infiltrators vehemently accuse the platform’s leadership of enforcing censorship, banishing highly active contributors, and exerting undue pressure upon the groups responsible for uploading new releases.
The most explosive revelation within the publication concerns the site’s underlying database. The architects of the breach assert that they unearthed records detailing 54,776 user credit cards embedded within the code. Furthermore, the architecture allegedly harbors insidious tools engineered to monitor visitor behavior, alongside the digital fingerprints of cryptocurrency wallets. Adding to the controversy, the infrastructure was found to contain copies of stolen identity documents, presumably utilized to covertly finance the server hosting.
The hackers maintain that they have seized access to the project’s internal documents, financial ledgers, and the personal information of its administrators. Nevertheless, they have vowed to abstain from publishing the sensitive data of ordinary users—specifically, email addresses, IP coordinates, and passwords. The archive containing this colossal leak is presently being distributed via the torrent file archive_ygg.torrent.
At present, the authenticity of these published materials remains independently unverified. The administration of YggTorrent has, thus far, abstained from offering any public commentary regarding the breach. Predictably, this volatile situation has drawn the attention of ARCOM, the French regulatory authority dedicated to combating digital piracy.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.