Back to Victim Disclosures

ilex-paysages.com

settraransomware groupilex-paysages.com
Published
3d ago

Added Jun 30, 2026

Revenue: 5,000,000 Size: 116GB | LANDSCAPE ARCHIVE: How Ilex Paysages et Urbanisme Stores Its Own — and Others' — Secrets PROLOGUE Thousands of internal documents. Multi-million-euro contracts. Employee personal data including Social Security numbers and banking details. Payment records of private individuals. Internal server paths to French government systems. Internal correspondence. Cost estimates for contracts worth tens of millions of euros. Financial reports on projects in Marseille, Lyon, Nantes, Vénissieux, and more than a dozen other French cities. Budgets with employee hourly rates. Consolidated contract summaries with public-sector clients. Personal documents — including account numbers and insurance certificates. Scanned receipts of private individuals with full payment details. This article covers only a portion of the data we have chosen to disclose. Everything else will be available for download and independent review once the full archive is published. --- Part I. Who Ilex Paysages + Urbanisme Are Three words. One firm. Twenty years of public contracts. Ilex Paysages et Urbanisme is a French landscape architecture and urbanism agency, headquartered in Lyon, 69007, rue Garibaldi. Their specialty: designing public spaces, eco-districts, and concerted development zones (ZAC — Zones d'Aménagement Concerté) for municipalities and public-sector developers. Clients and partners: Établissement Public d'Aménagement Euroméditerranée (Marseille), Métropole de Lyon , Nantes Métropole , Euralille , and the municipal governments of dozens of French cities. Subcontractors include the firms Atelier Lion and François Kern , engineering company Egis , and scientific partner CNRS Montpellier . Their contract base is public procurement: negotiated procedures under Article 104-1-9 of the French Public Contracts Code (CMP), public works supervision contracts (MARCHÉ DE MAÎTRISE D'ŒUVRE), and ZAC contracts worth tens of millions of euros. One contract, one public-sector client. The full history of every defect and cost overrun is inside the archive. --- Part II. The Money Contract 495: €37 Million in Construction Works We have the complete consolidated contract summary. Here is an example of one such document: | Item | Original Contract (excl. VAT) | Amendment No. 1 (excl. VAT) | |---|---|---| | Construction works cost | €34,994,000 | €37,146,000 | | Architect/landscape architect fees | €5,116,000 | €5,430,615 | | Increase under amendment | — | +6.15% | Breakdown by tranche: | Tranche | Works (excl. VAT) | Fees (excl. VAT) | |---|---|---| | Fixed tranche | €24,500,576 | €3,923,433 | | Conditional tranche 1 | €6,725,000 | €797,333 | | Conditional tranche 2 | €5,920,424 | €709,849 | The contractual fee rate is 14.6196% of the works cost. This is an internal calculation file containing the full financial structure of a public contract. ZAC Malbosc (Montpellier): Financial Tracking by Partner — Fully in the Archive The internal financial execution table for ZAC Malbosc (Montpellier): a multi-phase project with a total construction works value of €12,881,941.96 (excl. VAT) (confirmed by Service Order No. 5). Consortium members and cumulative completion across all phases: | Partner | Cumulative completion (excl. VAT) | |---|---| | François Kern (François Kern Architecte) | ~€1,249,072 | | Ilex | ~€673,372 | | OTH Méditerranée | ~€583,293 | | Ingerop | Individual phases | Total contract fee: €1,758,154.70 (excl. VAT) . The table includes a breakdown by phase, service orders, advances, amounts due, and price revisions. This is the operational financial reporting that contractors submit to their public-sector client. Active 2025 Project: MDL Quai Neuville — Signed Document in the Archive DEMANDE D'AGRÉMENT DE FOURNITURE (a supplier approval request) for the MDL — QUAI NEUVILLE project in Lyon: - Phase: Phase 1 — Requalification of avenue Jean Christophe and the lower northern quay - Lot 2, issued by CHAZAL, index Ind1 — 16/05/2025 - Products: bird nesting boxes (Mésanges and Rouge Queue Noir models), supplier VALLIANCE The document contains the decision of the project supervisor (Maître d'œuvre) (Ilex) — a partial rejection requiring replacement of the model: > "Replace the 'Mésanges 1B 26mm 3u model' with three nesting boxes with a Ø28mm opening, in accordance with the CCTP of the DCE." Signed by: COGNARD Pauline , dated 06/06/2025 . This is an active, ongoing project: the contract is being executed right now, and the decisions being made under it are in the archive. --- Part III. Personal Data: IBANs, Social Security Numbers — All in One Archive We have numerous contribution documents for Ilex Paysages' employee mutual insurance scheme. Among them: Isabelle Vignolles — Ilex Paysages Employee | Field | Data | |---|---| | Full name | Isabelle Vignolles | | Address | 293 rue Garibaldi, 69007 Lyon | | Email | isabelle.vignolles@ilex-paysages.com | | Phone | 06.77.81.17.47 | | Date of birth | 17/09/1969 | | Social Security number | 2 69 09 33 039 019 15 | | IBAN | FR7630003012020005032356857 | | BIC | SOGEFRPP | | Bank | SG Lyon Garibaldi (Société Générale) | | SEPA mandate | Signed electronically | The French Social Security number is a unique individual identifier encoding the person's sex, year, and place of birth. Combined with the IBAN and BIC, this constitutes a complete set of credentials for unauthorized SEPA direct debiting. Franck Cramette | Field | Data | |---|---| | Full name | Franck Cramette | | Date of birth | 11/12/1970 | | Social Security number | 1 70 12 71 073 016 58 | | Organization code | 01 691 895 4 | The company issued GDPR compliance notices. At the same time, the personal data of its employees — including Social Security numbers and banking details — is now in our possession. Private Individuals: Payment Data Among the documents are personal receipts belonging to private individuals with no professional connection to the company: Felix Lacoste: - Address: 44 avenue Berthelot, Lyon - Email: felix.s.lacoste@gmail.com - Phone: +33635240359 - Vélo'v Plus subscription (Lyon city bike scheme), 1 year, €99 , valid 27/11/2025–27/11/2026 - Subscription number: 14101025 Julien Pacia: - Donation to the NGO Disclose (an investigative media outlet), €120 , date: 18/09/2025 - Payment method: SEPA Payment receipt from an unidentified website naturalclick.gr (Greece): - Amount: €64.60 , date: 30/05/2026 12:40 - Card: \ \ \ 9426 - Transaction code: 157126443979761509 Private financial documents belonging to private individuals sit in the same archive as multi-million-euro public contracts. --- Part IV. Employee Budgets: Rates, Overruns, Names The internal project budget for "Atelier Mobiliers Neuville" lists employee hourly rates identified by initials: | Employee | Hours | Rate | Total | |---|---|---|---| | Project manager | 10 | €125/hr | €1,250 | | FB | 21 | €100/hr | €2,100 | | YB | 24 | €100/hr | €2,400 | | ML | 46 | €100/hr | €4,600 | Total labor cost: €10,782.65 (including consumables: spray paint, printing, LEGO). Approved budget: €6,000. Actual labor costs exceeded the budget by 79.7% . This is an internal document not intended for the public-sector client. --- Part V. Contamination That Never Became Public Parc Marcel Cachin, Saint-Denis: Official ARS Health Order An official ruling from the Île-de-France Regional Health Agency (ARS) — a public health order concerning soil contamination at the public Parc Marcel Cachin in Saint-Denis (93). The document was produced in connection with the park's reconstruction works, for which Ilex Paysages + Urbanisme served as the design firm. The responsible ARS officer: > Flore TAURINES , flore.taurines@ars.sante.fr , tel. 01 41 60 70 59 , ARS IDF, 13 rue du Landy, 93200 Saint-Denis Findings of the diagnostic assessment: The city of Saint-Denis submitted soil analysis results on December 3, 2021. The findings revealed severely degraded soil conditions: heavy metals (TME), hydrocarbons , polycyclic aromatic hydrocarbons (PAHs) , and polychlorinated biphenyls (PCBs) . From January 31, 2022, the ARS formally banned the consumption of fruits and vegetables grown in the park's allotment beds. Lead contamination — data by zone: | Zone | Description | ARS Recommendation | |---|---|---| | D2 (center of park) | Lead >500 mg/kg , up to >1,000 mg/kg | Make soil inaccessible — covering or fencing off | | D4 (children's playground) | Contaminated soil | Block access to ground surface by covering | | ERP2 (nursery school) | Nursery zone within the park | Specific risk management directives | | P2 (walking area) | Lead <500 mg/kg | Walking permitted; lying down and picnicking prohibited | The ARS recommended free blood-lead level testing (screening for lead poisoning/saturnism ) for children under 7, pregnant women, and anyone who had regularly visited the park. Screening is 100% covered. --- Part VI. The Fabriques Project (Marseille): Partner Network and Scientific Data An internal agency article about the "Les Fabriques" project (15th arrondissement of Marseille) reveals the full chain of participants in Euroméditerranée's flagship eco-district project: - Ilex Paysage — lead landscape architect - Établissement Public d'Aménagement Euroméditerranée — public developer - Egis — engineering consultant - CNRS Montpellier — scientific partner (subject of Louise Authier's doctoral thesis on mycorrhizal communities) - Efficacity — technology partner - Parcs et Sports — operations partner Project area: 14 hectares , with 20% dedicated to green space. Experimental garden: 2,200 m², 36 planting pits . Study duration: 3 years . Complete technical results are included: plant survival data by species, soil inoculation methodology, mycorrhizal community analysis results, and comparative data on irrigation systems. These are scientific findings produced in collaboration with CNRS as part of a doctoral dissertation (Louise Authier), portions of which were under embargo during the defense period. Also present is the document "Préfiguration du jardin des Fabriques" — an internal study for the next phase of the district's green infrastructure. And in the document EUR PUCES CAHIER-PRESCRIPTIONS , dated January 30, 2026 (Euroméditerranée II, "Littorale" project, Les Puces sector), Ilex is named as the originator of the concept that forms the basis of the new district. This is not a historical reference — it is active design work being carried out this year. --- Part VII. Four Points Where the Archive Speaks for Itself IBAN and Social Security number. Employee data: IBAN, BIC, electronically signed SEPA mandate, and Social Security number — all contained in a routine mutual insurance contribution summary, filed alongside contract tables worth tens of millions of euros. The French Social Security number encodes the person's sex, birth year, and département of birth. The SEPA mandate is an authorization to debit the account. Official ARS order on lead contamination in a children's zone. The ARS Île-de-France documented: zone D4 (the children's playground at Parc Marcel Cachin) contains contaminated soil and must be closed off; zone D2 at the center of the park shows lead levels above 1,000 mg/kg; the nursery in zone ERP2 is subject to separate risk directives. Personal data of unrelated private individuals — held without their knowledge. Félix Lacoste (home address, email, phone number, city bike subscription number) and Julien Pacia (donation amount and date to investigative outlet Disclose, SEPA payment method) are neither employees nor clients of Ilex. Their personal financial documents were stored in the same archive as public contracts. This is a GDPR violation affecting third parties — and these individuals appear to be unaware of it. A public-sector project budget exceeded its estimate by 79.7%. The Neuville project: €10,782 in actual costs against an approved budget of €6,000. Employee rates listed by initials are in the same file. The gap between internal labor costs and the figure agreed with the client is no longer known only to the agency's accounting department. --- Who This Is Addressed To Regulators and Public Authorities You now have: Social Security numbers of employees of a private company stored in an unprotected archive — a violation of the GDPR and the French Data Protection Act (Loi Informatique et Libertés); banking details including signed SEPA mandates; personal payment documents of private individuals whose consent was never sought; an official ARS public health order documenting lead contamination of a children's playground and nursery in a public park — held in a private contractor's folder, not in the city's public registry. Employees of Ilex Paysages + Urbanisme Your data is in our possession. Social Security number. IBAN. Date of birth. Home address. Email. All of it — in documents filed alongside contract tables and budget summaries. You are not responsible for how the company stored this information. But the SEPA mandate bearing your signature is an authorization to debit your account. The Company's Clients and Partners Fee rates by contract, the monthly payment schedule for the Marseille project, hourly rates of specific employees. If you are a client of Ilex — you know what the agency knows about your budget. Now we know it too. Residents of the Neighborhood Around Parc Marcel Cachin (Saint-Denis) The official ARS assessment of soil contamination, recommendations for restricting access to children's zones, and directives for the nursery school — are in a contractor's project archive. ---

Organization Details

Organization

ilex-paysages.com

Domain

ilex-paysages.com

ilex-paysages.com

Leak Data

Published

Jun 30, 2026

Publication Status

Published

Discovered

Jun 30, 2026