{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en","total":14,"returned":14,"offset":0,"limit":100,"withoutPublishedCount":8},"incidents":[{"id":"dgfip","date":"2026-08-14","year":2026,"org":"DGFiP tax systems","domain":"economie.gouv.fr","kind":"government","sector":"Finance / tax","sectorLabel":"Finance / tax","severity":"critical","status":"confirmed","affected":678000,"affectedLabel":"678,000 individuals and businesses","data":"Tax data including reference income, household quotient and withholding rate; business name/SIREN. Cadastral data also consulted. User tax-space passwords not compromised.","method":"Stolen credentials of a DGFiP agent and an authorised third party.","risk":"Highly persuasive tax and wealth-targeted scams using real fiscal circumstances.","confidence":"Official government disclosure; investigation ongoing","sourceName":"French Finance Ministry","sourceId":"dgfip","sourceUrl":"https://presse.economie.gouv.fr/acces-illegitime-au-systeme-dinformation-de-la-direction-generale-des-finances-publiques/","sourceIds":["dgfip","dgfipLemonde","dgfipBriefing","dgfipEntrevue"],"lastResearched":"2026-08-16","url":"/incident/dgfip","detail":{"lead":"The DGFiP confirmed on 14 August 2026 that two illegitimate-access incidents in June and July had relied on stolen or impersonated credentials belonging to a DGFiP agent and an authorised third party. When the intrusions were detected, access to the implicated accounts was cut. At that time, however, the access-control review did not identify that data had already been stolen.\n\nThe decisive trigger came on 12 and 13 August, when a malicious actor publicly claimed the intrusions. DGFiP then matched the claims against its logs and established that data concerning a total of 678,000 individuals and businesses had been consulted and extracted before access was terminated.","timeline":[{"date":"2026-06-30","label":"A DGFiP agent account is compromised or impersonated (late June). Access is detected and cut. Data theft is not identified at that moment."},{"date":"2026-07-15","label":"A second illegitimate-access incident occurs in July using credentials of an authorised third party, according to the Finance Ministry’s later statement (exact day not published)."},{"date":"2026-08-12","label":"A malicious actor publicly claims access. DGFiP begins deeper investigation against historical logs."},{"date":"2026-08-13","label":"A further claim or disclosure is made by the malicious actor."},{"date":"2026-08-14","label":"Finance Ministry confirms 678,000 individuals and businesses in the established extracted or consulted scope. User tax-space credentials are said to be unaffected."},{"date":"2026-08-16","label":"French reporting says the Paris prosecutor’s cyber section has opened an investigation and entrusted it to OFAC."},{"date":"2026-08-17","label":"DGFiP plans to contact each affected individual or business from the week of 17 August, with details of the data that may have been consulted or extracted."}],"how":"The official account says the incidents rested on credential impersonation: one DGFiP agent and one authorised third party. The Finance Ministry has not publicly supplied the complete authentication architecture or confirmed the attacker’s claims about specific remote-access products. DGFiP said the theft was missed during the initial response because the attack was sophisticated. Press reporting based on a briefing by director-general Amélie Verdier adds that extraction was slow or broken into patterns that did not look like obvious bulk querying.","taken":"The written government statement sets the confirmed combined scope at 678,000 individuals and businesses. It lists reference taxable income, household quotient, withholding-tax rate, business name and SIREN, plus cadastral information relating to addresses and property surface areas.\n\nPress briefing coverage separately reported a cadastral consultation involving around 200,000 accounts. The 14 August written release does not establish that as a second additive victim population, so it is not added to the 678,000.","notTaken":"The Finance Ministry said individual and business Finances publiques spaces were not compromised and that user identifiers and passwords for those spaces were not compromised. Stolen tax data can make fraud extremely convincing, but it does not itself provide a login to a taxpayer’s secured account.","impact":"This is one of the highest-risk identity datasets in the collection because it reveals both personal identity and financial circumstances. A scammer who knows a victim’s reference income, household quotient and withholding rate can convincingly impersonate the tax authority, a bank, accountant or wealth-management service. For high-income households, disclosure may also create targeting and physical-security concerns that go beyond ordinary email phishing.","response":"DGFiP cut access associated with the compromised accounts, then made additional preventive cuts to sensitive information systems after the August discoveries. It notified the CNIL, worked with SHFDS and ANSSI, planned individual notification, and announced a criminal complaint. Reporting on 16 August said a Paris prosecutor investigation had been opened with OFAC.","methodDisclosure":"disclosed","revision":"This case was still evolving at the research cutoff. Criminal posts described a VPN and made additional claims about bypassing authentication controls; those claims remain separate from the official method. The written release also says the exact nature and volume of extracted data and the final number of users concerned were still being investigated, so even the 678,000 figure should be understood as the established scope at 14 August, not necessarily the final endpoint of the inquiry.","quotes":[{"text":"a total of 678,000 individuals and businesses","original":"un total de 678 000 particuliers et professionnels","originalLang":"fr","attribution":"French Finance Ministry, 14 August 2026","sourceId":"dgfip"},{"text":"were not compromised","original":"n’ont pas été compromis","originalLang":"fr","attribution":"French Finance Ministry, 14 August 2026, referring to users’ secured tax spaces and credentials","sourceId":"dgfip"}]}},{"id":"sante","date":"2026-08-13","year":2026,"org":"Santé publique France contractor","domain":"santepubliquefrance.fr","kind":"government","sector":"Public health","sectorLabel":"Public health","severity":"high","status":"confirmed","affected":80000,"affectedLabel":"About 80,000 contact records","data":"Email, postal address and telephone. No medical data, diagnoses or social-security numbers.","method":"Attack on a contractor-hosted ordering platform. Initial access not disclosed.","risk":"Health-themed impersonation using real contact details.","confidence":"Agency confirmation reported by French press","sourceName":"Le Parisien / AFP","sourceId":"santeParisien","sourceUrl":"https://www.leparisien.fr/faits-divers/cyberattaque-dun-prestataire-de-sante-publique-france-80-000-personnes-concernees-par-la-fuite-de-donnees-13-08-2026-FTP4SNTQI5DOVMQDCBBTQX5F4U.php","sourceIds":["santeParisien","sante"],"lastResearched":"2026-08-16","url":"/incident/sante","detail":{"lead":"Santé publique France confirmed on 13 August 2026 that a contractor-hosted platform used to order public-health prevention materials had been attacked. The affected service, moncoupon.santepubliquefrance.fr, operates separately from the agency’s other sites and systems.\n\nAbout 80,000 contact records were affected. The database was used to ship ordered materials and contained email addresses, postal addresses and telephone numbers. This is a public-health-sector breach, but not a breach of medical records.","timeline":[{"date":"2026-08-11","label":"An online claim about the platform appears, according to incident reporting."},{"date":"2026-08-13","label":"Santé publique France confirms that a contractor-operated ordering platform has been attacked and that about 80,000 contact records are concerned."}],"how":"The affected service was a separate contractor-hosted platform used for ordering prevention materials. Santé publique France said it was independent of the agency’s other websites and systems. The initial access path was not disclosed. Posts attributed to the attacker described administrator access and use of an export function; those details are an attacker account, not an official technical finding.","taken":"Contact and delivery fields such as email, postal address and telephone number. Reporting on samples also referred to professional role or organisation for some records. The agency-confirmed scale is approximately 80,000 people.","notTaken":"Santé publique France said there were no medical records, diagnoses or social-security numbers in the affected database. The platform was separate from the agency’s other systems.","impact":"The biggest practical risk is health-themed impersonation. Victims may be more likely to trust a message that knows their contact information and refers to a real prevention-material order or Santé publique France context. The brand association can amplify phishing even without clinical data.","response":"The platform was taken into maintenance, passwords were cleared, the CNIL was notified and restoration work began. Public communications emphasised that no health or social-security data was present and warned about follow-on fraud.","methodDisclosure":"partial","revision":"The case was only days old at the 16 August research cutoff. Method, contractor root cause and any later law-enforcement result remain open. Attacker claims of administrator access and an export function stay labeled as claims.","quotes":[{"text":"no health data","original":"aucune donnée de santé","originalLang":"fr","attribution":"Santé publique France, reported by French press, 13 August 2026","sourceId":"santeParisien"}]}},{"id":"ceva","date":"2026-07-29","year":2026,"org":"CEVA Logistics","domain":"cevalogistics.com","kind":"company","sector":"Logistics / supply chain","sectorLabel":"Logistics / supply chain","severity":"high","status":"confirmed","affected":null,"affectedLabel":"Unknown person count; eight European warehouses","data":"Delivery data for downstream clients: names, addresses, phones, emails and order details.","method":"Initial access not publicly confirmed.","risk":"Supply-chain blast radius and tailored package scams.","confidence":"Confirmed by CEVA to customers and press; technical details limited","sourceName":"TechCrunch","sourceId":"cevaTechcrunch","sourceUrl":"https://techcrunch.com/2026/08/10/a-data-breach-at-shipping-giant-ceva-logistics-is-rippling-across-banks-retailers-steam-gamers-and-beyond/","sourceIds":["cevaTechcrunch","cevaVerge","cevaPcgamer","cevaComputing","ceva"],"lastResearched":"2026-08-16","url":"/incident/ceva","detail":{"lead":"A cyber intrusion hit part of CEVA Logistics’ European contract-logistics operation beginning around 29 July 2026. CEVA told affected customers that the incident was identified on 1 August and later confirmed to press that the operational impact was limited to eight European warehouses.\n\nThe breach became visible through CEVA’s customers. Downstream retailers and Valve, which uses CEVA to ship Steam hardware in Europe, warned that shipping information held by CEVA had been accessed or copied. No public person count has been established.","timeline":[{"date":"2026-07-29","label":"Start of the intrusion window later communicated in Valve-related notices and reporting."},{"date":"2026-08-01","label":"CEVA identifies the intrusion, activates security measures and informs affected customers. Operational impact is later described as limited to eight European warehouses."},{"date":"2026-08-07","label":"Valve says it learns that information relating to its European hardware customers was likely compromised. CEVA retained Valve delivery information for up to 90 days after an order."},{"date":"2026-08-10","label":"TechCrunch and other outlets detail the multi-client impact. Valve begins broad customer notification."},{"date":"2026-08-12","label":"Additional reporting identifies more affected retailers and notes that the Dutch data-protection authority has received multiple breach notifications connected with the CEVA incident."}],"how":"CEVA has not published an initial access method, vulnerability, ransomware family or attacker. Physical operational disruption at warehouses led some commentators to speculate about ransomware or destructive malware; that is not a confirmed technical finding. The confirmed response facts are that CEVA isolated affected systems, activated security protocols and brought in external investigators.","taken":"For Valve customers, the likely exposed fields were name, street address, phone number, email address, and hardware product type or order details. Other CEVA clients reported overlapping sets of delivery and customer-contact data. The exact total volume across all clients is unknown. Adding each company’s notification count would also risk double counting.","notTaken":"Valve said CEVA does not hold Steam payment information, passwords, Steam Guard codes or other Steam account credentials. CEVA told reporters that air, ocean, ground and rail operations continued and that the identified operational effect was limited to eight warehouses.","impact":"The breach creates two layers of risk. Operationally, warehouse disruption can delay orders, returns and refunds. From a privacy perspective, stolen delivery context enables persuasive package scams: a criminal who knows a victim’s address and exact recent hardware purchase can plausibly demand a small customs payment, redelivery fee or account verification.","response":"CEVA activated security protocols, isolated affected systems and engaged external investigators. Downstream clients began notifying their customers and relevant data-protection authorities. Valve explicitly warned customers to expect fake messages and said it was pressing CEVA for a fuller account of what had been taken and how.","methodDisclosure":"undisclosed","revision":"The investigation remained ongoing at the 16 August research cutoff. Technical method, total number of affected people and final number of client organisations should be treated as provisional.","quotes":[{"text":"expect fake messages","original":"expect fake messages","originalLang":"en","attribution":"Valve customer notice, reported 10 August 2026","sourceId":"cevaVerge"},{"text":"Treat all of them as fake.","original":"Treat all of them as fake.","originalLang":"en","attribution":"Valve customer notice, reported 10 August 2026","sourceId":"cevaVerge"}]}},{"id":"edustaff","date":"2026-07-25","year":2026,"org":"Education Ministry staff system","domain":"education.gouv.fr","kind":"government","sector":"Education","sectorLabel":"Education","severity":"critical","status":"confirmed","affected":null,"affectedLabel":"A “significant number” of agents since 2001; exact count unpublished","data":"Identity and professional data; for some, address, phone and social-security number. No banking, passwords or pupil data.","method":"Impersonation of a professional account.","risk":"Durable identity fraud using social-security numbers and employment context.","confidence":"Official disclosure; headcount still unpublished","sourceName":"French Education Ministry","sourceId":"eduStaff","sourceUrl":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-personnels-de-l-education-nationale-505407","sourceIds":["eduStaff"],"lastResearched":"2026-08-16","url":"/incident/edustaff","detail":{"lead":"The Education Ministry disclosed on 31 July 2026 that a professional account had been impersonated during the night of 25 July, giving fraudulent access to an information system dedicated to staff training. The ministry security operations centre was alerted on 26 July and external access was suspended.\n\nThe system contained identity and professional information about agents who had worked in academies since 2001. The ministry described the potential population only as a significant number of agents. No official quantified update was found before the 16 August research cutoff.","timeline":[{"date":"2026-07-25","label":"Fraudulent access occurs during the night after impersonation of a professional account."},{"date":"2026-07-26","label":"COSSIM is alerted. External access to the system is suspended and a crisis cell is activated."},{"date":"2026-07-31","label":"The ministry publicly discloses the incident and says the exact scope is still under investigation."}],"how":"The ministry describes the mechanism as impersonation of a professional account. It does not disclose how that account was compromised, whether MFA was present, or whether any software flaw was also involved. This is the third major Education Ministry incident in the 2026 dataset and the second whose public core is compromised credentials.","taken":"Potentially exposed information covers identity and professional data, including status and functions, for staff who worked in academies since 2001. For some records, postal address, phone number and social-security number are also present. Because the exact number remains unknown, no numeric value is used in aggregate charts.","notTaken":"The ministry explicitly states that the system does not contain banking data, passwords or pupil data.","impact":"Social-security numbers and long-lived identity information create durable fraud risk. Unlike a password, a social-security identifier is not something a person can simply rotate after a breach. Employment role and contact details also support convincing ministry or payroll impersonation.","response":"The ministry suspended external access, activated a crisis cell, filed a complaint, notified ANSSI and CNIL, began checks across its other systems, and said potentially affected staff would be informed. It also reiterated that it had been strengthening security for several months.","methodDisclosure":"partial","revision":"No later official public person count was identified through the 16 August research cutoff. The record does not guess a headcount from the age of the database or the size of the ministry.","quotes":[{"text":"a significant number of its agents","original":"un nombre important de ses agents","originalLang":"fr","attribution":"French Education Ministry, 31 July 2026","sourceId":"eduStaff"},{"text":"the investigations are continuing","original":"les investigations se poursuivent","originalLang":"fr","attribution":"French Education Ministry, 31 July 2026","sourceId":"eduStaff"}]}},{"id":"ants","date":"2026-04-15","year":2026,"org":"France Titres / ANTS","domain":"ants.gouv.fr","kind":"government","sector":"Identity / public services","sectorLabel":"Identity / public services","severity":"critical","status":"confirmed","affected":11700000,"affectedLabel":"About 11.7 million accounts that may be concerned","data":"Login identifier, title, names, email, date of birth and unique account ID; sometimes postal address, place of birth and phone.","method":"Official cause still under investigation.","risk":"Government-themed identity phishing around licences, passports and ID documents.","confidence":"Official update; origin still under investigation","sourceName":"France Titres (ANTS)","sourceId":"ants","sourceUrl":"https://mairie.ants.gouv.fr/toute-l-actualite/incident-de-securite-relatif-au-portail-antsgouvfr-point-detape-du-21-avril-2026","sourceIds":["ants","antsInterior","antsTf1Maintenance","antsLemonde","antsLemondeArrest","antsTf1Breach3d"],"lastResearched":"2026-08-16","url":"/incident/ants","detail":{"lead":"France Titres, also known as ANTS, detected a security incident on 15 April 2026 involving the ants.gouv.fr portal. The 21 April official update said about 11.7 million individual and professional accounts could be concerned.\n\nThat figure is phrased as accounts that may be concerned. It should not automatically be read as 11.7 million complete records definitely downloaded. Criminal claims of roughly 18 to 19 million records are not the official count.","timeline":[{"date":"2026-04-15","label":"ANTS detects the security incident."},{"date":"2026-04-16","label":"ANTS reports to the Paris prosecutor that data presented as coming from the incident is being offered for sale. A cyber investigation begins."},{"date":"2026-04-21","label":"Official update: 11.7 million accounts may be concerned. Technical investigation of origin and scope is still ongoing."},{"date":"2026-04-24","label":"ANTS places the portal into maintenance from 19:30 to continue security strengthening."},{"date":"2026-04-25","label":"A 15-year-old suspect is arrested."},{"date":"2026-04-30","label":"Paris prosecutor publicly announces the arrest and says the minor is suspected of having contributed to the leak."}],"how":"The principal ANTS update does not name an initial-access vector or vulnerability. It says internal technical investigations are working to establish origin and scope. Later journalism described an IDOR-style API weakness; researchers also said they had previously reported security flaws. Those accounts remain reporting unless France Titres, investigators or a judicial record confirms the specific technical path.","taken":"Potentially affected fields include login identifier, civil-status title, surname and given names, email, date of birth and a unique account ID. For some accounts the dataset also includes postal address, place of birth and phone number. ANTS said the disclosed fields by themselves did not allow someone to log into the named ANTS account.","notTaken":"At the 21 April stage, ANTS excluded supporting documents uploaded for administrative procedures and biometric data. Passwords were not listed among the disclosed fields.","impact":"The data is highly suitable for government-themed identity phishing. A fraudster can cite a real date of birth, address or ANTS context and impersonate a driving-licence, passport, registration or identity-document process. The main direct danger is not that the leaked fields themselves unlock the portal, but that they make the next social-engineering step more convincing.","response":"ANTS notified CNIL, referred the matter to the Paris prosecutor, and an OFAC investigation was opened. The Interior Minister asked the Inspection générale de l’administration to establish the chain of responsibility. Professional and individual users were informed. ANTS advised password changes at the next login as a precaution. The portal was later placed in maintenance for additional hardening.","methodDisclosure":"undisclosed","attackerClaim":"Sellers on criminal forums claimed a larger dataset, generally in the 18 to 19 million-record range. Official government communications used 11.7 million accounts as the potential scope. The later arrest of a minor suspected of contributing to the leak does not validate the advertised volume.","revision":"A 15-year-old was arrested on 25 April. On 30 April the Paris prosecutor said the minor was suspected of having contributed to the data leak. A government information page that mistakenly referred to detection on 15 March is not used here: primary ANTS and Interior Ministry material consistently says 15 April.","quotes":[{"text":"11.7 million accounts may be concerned","original":"11,7 millions de comptes seraient concernés","originalLang":"fr","attribution":"France Titres / Interior Ministry, 21 April 2026","sourceId":"ants"},{"text":"internal technical investigations","original":"investigations techniques internes","originalLang":"fr","attribution":"France Titres, 21 April 2026","sourceId":"ants"}]}},{"id":"edustudents","date":"2026-04-14","year":2026,"org":"Education Ministry / ÉduConnect","domain":"education.gouv.fr","kind":"government","sector":"Education","sectorLabel":"Education","severity":"critical","status":"confirmed","affected":null,"affectedLabel":"Official pupil count unpublished","data":"Name, ÉduConnect identifier, school and class, email if supplied, and activation code for accounts not yet activated.","method":"Impersonated staff account plus a vulnerability exploited shortly before it was fixed.","risk":"School-themed phishing aimed at pupils and parents.","confidence":"Official disclosure; exact pupil count unpublished","sourceName":"French Education Ministry","sourceId":"eduStudents","sourceUrl":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-eleves-de-l-education-nationale-504443","sourceIds":["eduStudents","eduStudentsLemonde","eduStudentsAa","eduStudents01net"],"lastResearched":"2026-08-16","url":"/incident/edustudents","detail":{"lead":"The Education Ministry disclosed on 14 April 2026 that pupil data had been exfiltrated from a service adjacent to ÉduConnect. An authorised staff account was impersonated at the end of 2025, and a security flaw identified in December 2025 was exploited shortly before it was fixed.\n\nThe ministry confirmed exfiltration but did not publish a final pupil count. Criminal claims of 3.5 million pupils and 7.2 million report cards remain claims, not the ministry’s verified scope.","timeline":[{"date":"2025-12-01","label":"An authorised staff account is impersonated at the end of 2025, giving fraudulent access to the pupil-account management service (exact day not published)."},{"date":"2025-12-15","label":"A vulnerability in the service is identified in December and, the ministry says, exploited shortly before it was fixed (exact day not published)."},{"date":"2026-04-12","label":"A criminal group publicly advertises data it claims came from the education environment, including a multi-million-pupil figure."},{"date":"2026-04-14","label":"Education Ministry publicly confirms exfiltration; the exact pupil count is still under evaluation."},{"date":"2026-04-18","label":"Le Monde reports that the ministry still does not know the exact number of pupils affected."},{"date":"2026-06-09","label":"French investigators arrest seven people reported as alleged members of DumpSec, in a broader investigation into more than 1,500 targeted entities. This is attribution context; it does not validate the advertised pupil count."},{"date":"2026-06-12","label":"Security reporting connects the arrests with a wider DumpSec campaign and repeats the group’s ÉduConnect claims. Those numbers still remain outside the ministry’s confirmed count."}],"how":"Unlike COMPAS, this incident combines compromised identity with a software weakness. The ministry says an authorised staff account was impersonated and that a vulnerability in the account-management service was exploited shortly before it was fixed. The public statement does not name the vulnerability, provide a CVE, or explain the precise request sequence.","taken":"Officially confirmed fields are pupil first and last name, ÉduConnect identifier, school and class, email if provided, and activation code only for accounts not yet activated. The ministry confirmed data exfiltration. It did not publish a final pupil count by the research cutoff.","notTaken":"The ministry says accounts already activated by pupils and their guardians were not compromised and could continue to be used safely. It reset codes for unactivated accounts and blocked undistributed or unactivated accounts. The official field list does not include health data or social-security numbers.","impact":"Because the dataset concerns minors and schools, the main risk is highly credible school-themed phishing aimed at pupils and parents. School, class, identity and activation context can be used to impersonate a school administrator, parent portal or account-support process.","response":"The ministry suspended access to the affected service, activated a crisis cell, reset activation codes, blocked unactivated accounts, began strengthening access with MFA, notified ANSSI and CNIL, and filed a complaint. Families were warned to be alert to school-themed fraud.","methodDisclosure":"partial","attackerClaim":"DumpSec, or accounts attributed to the group, advertised about 3.5 million pupils and 7.2 million report cards. Those figures remain criminal claims. They are not a substitute for a ministry-verified pupil count.","revision":"In June 2026, French investigators arrested seven people reported as alleged DumpSec members in a broader investigation. That improves attribution context at campaign level. It does not validate the advertised pupil or report-card counts, and the official student count remains unpublished.","quotes":[{"text":"the exact number is being evaluated","original":"le nombre exact est en cours d’évaluation","originalLang":"fr","attribution":"French Education Ministry, 14 April 2026","sourceId":"eduStudents"},{"text":"impersonation of an authorised staff member’s account","original":"usurpation d’identité du compte d’un personnel habilité","originalLang":"fr","attribution":"French Education Ministry, 14 April 2026","sourceId":"eduStudents"}]}},{"id":"educompas","date":"2026-03-15","year":2026,"org":"Education Ministry / COMPAS","domain":"education.gouv.fr","kind":"government","sector":"Education","sectorLabel":"Education","severity":"high","status":"confirmed","affected":243000,"affectedLabel":"About 243,000 agents, trainees and permanent staff","data":"Identity, addresses, phone numbers and absence periods without the medical reason; tutor names and professional numbers.","method":"Impersonation of an external account.","risk":"Harassment, impersonation and workplace-targeted fraud against education staff.","confidence":"Official government disclosure","sourceName":"French Education Ministry","sourceId":"eduCompas","sourceUrl":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-personnels-de-l-education-nationale-470657","sourceIds":["eduCompas","eduCompasSenat","eduCompasRtl","eduCompasAef"],"lastResearched":"2026-08-16","url":"/incident/educompas","detail":{"lead":"An attacker used an impersonated external account to reach COMPAS, the Education Ministry information system used to manage trainee teachers. The fraudulent access occurred on 15 March 2026. The ministry’s security operations centre was alerted on 19 March after unauthorised dissemination of COMPAS data was identified.\n\nAbout 243,000 agents, including trainees and permanent staff recorded in the system, had data exfiltrated. That figure is an official approximate person count.","timeline":[{"date":"2026-03-15","label":"Fraudulent access to COMPAS occurs after impersonation of an external account."},{"date":"2026-03-19","label":"COSSIM, the ministry security operations centre, is alerted. External access is closed and a crisis cell is activated."},{"date":"2026-03-21","label":"CNIL is notified, according to a later Senate response."},{"date":"2026-03-23","label":"Public disclosure establishes an approximate 243,000-person scope."},{"date":"2026-03-24","label":"A complaint is filed, according to the minister’s Senate response."},{"date":"2026-04-01","label":"The ministry says the 243,000 people concerned will be individually informed by this date."}],"how":"The ministry says the access followed impersonation of an external account. It does not describe a software vulnerability in COMPAS or explain how the external account was obtained. The event is therefore compromised credentials used for valid authenticated access.","taken":"Names and other identity information, postal addresses, phone numbers and periods of absence without the health reason, for about 243,000 agents recorded in COMPAS. Tutor identity and professional telephone numbers were also exposed. Security reporting said samples later appeared on data-trading venues; any reseller volume is not a second official count.","notTaken":"The official disclosure emphasised that absence periods did not include the underlying health reason. The public primary source reviewed does not provide evidence for broader claims about medical files or banking credentials.","impact":"Teachers and other staff expressed concern that the data could be used to locate or target them. Real home addresses, phone numbers and employment context can support harassment, impersonation and tailored fraud even when the dataset does not contain passwords.","response":"The ministry suspended external access to COMPAS, activated a crisis cell, carried out checks across other systems, notified ANSSI and the CNIL, filed a complaint and informed staff. In parliamentary debate, the minister also described a wider government security programme focused on MFA, segmentation and reduced application exposure.","methodDisclosure":"partial","revision":"A later Senate response supplies dates for CNIL notification (21 March), the complaint (24 March) and planned individual notification (by 1 April). It strengthens the cross-case finding that credential impersonation is a recurring weakness.","quotes":[{"text":"impersonation of an external account","original":"usurpation d’un compte externe","originalLang":"fr","attribution":"French Education Ministry, 23–24 March 2026","sourceId":"eduCompas"},{"text":"about 243,000 agents","original":"environ 243 000 agents","originalLang":"fr","attribution":"French Education Ministry, 23–24 March 2026","sourceId":"eduCompas"}]}},{"id":"ficoba","date":"2026-01-31","year":2026,"org":"DGFiP / FICOBA","domain":"economie.gouv.fr","kind":"government","sector":"Finance / tax","sectorLabel":"Finance / tax","severity":"critical","status":"confirmed","affected":1200000,"affectedLabel":"About 1.2 million bank accounts","data":"Bank-account identifiers (RIB/IBAN), account-holder identity and postal address. The tax identifier was not consulted. No balances.","method":"Stolen credentials of a civil servant outside DGFiP, authorised for inter-ministry queries — not a FICOBA software flaw.","risk":"Targeted bank and tax phishing, identity fraud and fake-adviser scams.","confidence":"Official government disclosure and later parliamentary answers","sourceName":"French Finance Ministry","sourceId":"ficoba","sourceUrl":"https://presse.economie.gouv.fr/acces-illegitimes-au-fichier-national-des-comptes-bancaires-ficoba/","sourceIds":["ficoba","ficobaFaqPage","ficobaImpots","ficobaQ13230","ficobaQ13370"],"lastResearched":"2026-08-16","url":"/incident/ficoba","detail":{"lead":"From late January through 13 February 2026, an attacker used credentials belonging to a civil servant outside DGFiP who was authorised to query FICOBA for inter-ministry information exchange. About 1.2 million bank-account records — less than 1 percent of the register — were consulted or extracted.\n\nThe 1.2 million figure refers to bank accounts, not unique people. One person can hold more than one account, and one account can have several holders.","timeline":[{"date":"2026-01-28","label":"Illegitimate FICOBA consultations begin using the credentials of an authorised civil servant outside DGFiP."},{"date":"2026-02-13","label":"Last day of the illegitimate access window stated in later parliamentary answers."},{"date":"2026-02-16","label":"DGFiP makes its first CNIL notification, according to a later parliamentary response."},{"date":"2026-02-18","label":"Finance Ministry publicly discloses the incident and the approximately 1.2 million-account scope."},{"date":"2026-02-23","label":"DGFiP supplements its CNIL notification."},{"date":"2026-02-24","label":"Banks begin receiving securely transmitted information about their accounts in the consulted set."},{"date":"2026-04-28","label":"Parliamentary answer: the compromised account belonged to another administration, not a FICOBA software exploit."}],"how":"The attack used valid credentials attached to an authorised inter-ministry user outside DGFiP. The government has not published how those credentials were stolen. A parliamentary response states that the incident resulted from use of an account in a third administration and was not the result of a software vulnerability in FICOBA itself.","taken":"Bank-account identifiers such as RIB and IBAN, account-holder identity and postal address. The Finance Ministry said the tax identifier was not consulted during the illegitimate access.","notTaken":"FICOBA does not contain account balances or transaction history. The incident did not compromise bank passwords, impots.gouv.fr passwords or access to taxpayers’ secured tax spaces. An IBAN is sensitive for fraud, but it is not a credential that grants online-banking control.","impact":"The most credible downstream harms are targeted bank and tax phishing, identity fraud and attempts to create unauthorised direct debits. The combination of a real identity, address and IBAN is especially useful for a fake-bank adviser or administrative impersonation scam.","response":"DGFiP restricted external access, worked with ANSSI and ministry security officials, notified the CNIL, filed a complaint, contacted affected users, and provided banks with account-level information so they could strengthen monitoring and customer warnings. Later parliamentary responses say external access remained cut while security work continued.","methodDisclosure":"disclosed","revision":"Later parliamentary material confirms the first public account and adds the security-boundary finding: the compromised credentials belonged to a civil servant outside DGFiP, and the incident was not a FICOBA software exploit.","quotes":[{"text":"impersonated or used a civil servant’s credentials","original":"usurpé les identifiants d’un fonctionnaire","originalLang":"fr","attribution":"French Finance Ministry, 18 February 2026","sourceId":"ficoba"},{"text":"1.2 million accounts","original":"1,2 millions de comptes","originalLang":"fr","attribution":"French Finance Ministry, 18 February 2026","sourceId":"ficoba"}]}},{"id":"interior","date":"2025-12-11","year":2025,"org":"French Interior Ministry","domain":"interieur.gouv.fr","kind":"government","sector":"Law enforcement","sectorLabel":"Law enforcement","severity":"critical","status":"disputed","affected":null,"affectedLabel":"72 TAJ files and tens of thousands of TAJ index rows; 23 FPR files and ~3,000 FPR index elements; 1 Interpol file — not a person count","data":"72 full TAJ files plus tens of thousands of TAJ index rows; 23 FPR files plus ~3,000 FPR index elements; 1 Interpol file after 10 viewed. Not a person count.","method":"Compromised police mailboxes, then application passwords found in email, then a police portal. MFA stopped apps that already had it.","risk":"Exceptionally sensitive law-enforcement information, potential danger to individuals, investigations and operational security.","confidence":"Senate reconstruction of a confirmed breach; 16.4 million remains an attacker claim.","sourceName":"Sénat","sourceId":"interiorSenate","sourceUrl":"https://www.senat.fr/compte-rendu-commissions/20260112/lois.html","sourceIds":["interiorSenate","interiorSenateNews","interiorAssemblee","interiorPublicSenat","interior","interiorFrance24"],"lastResearched":"2026-08-16","url":"/incident/interior","detail":{"lead":"A criminal actor claimed access to data on more than 16 million people. The interior minister later rejected the idea that millions of complete records had been extracted. A Senate hearing on 13 January 2026 reconstructed a narrower, still serious scope: 72 full TAJ files plus tens of thousands of TAJ index rows, 23 FPR files plus about 3,000 FPR index elements, and 1 Interpol file exfiltrated after 10 were viewed. Those quantities are operational record counts, not a unique-person total.\n\nThe path ran from compromised professional mailboxes, through application passwords that agents had exchanged in email, to a Police nationale portal. Applications that already had MFA were attempted but not successfully penetrated.","timeline":[{"date":"2025-11-25","label":"DGPN notices that passwords to several police mailboxes have been changed."},{"date":"2025-11-28","label":"Services reset mailbox passwords themselves."},{"date":"2025-12-08","label":"The ministry knows that an unauthorised person has accessed a Police nationale portal and several applications. A criminal investigation is opened."},{"date":"2025-12-17","label":"Minister Laurent Nuñez publicly confirms access to TAJ and FPR and extraction of dozens of confidential files. A 22-year-old suspect is arrested."},{"date":"2026-01-13","label":"Nuñez gives the Senate the 72 TAJ, 23 FPR and Interpol figures, and describes MFA remediation."}],"how":"Compromised professional mailboxes gave the attacker access to messages in which some agents had exchanged passwords for internal applications. Those credentials opened a police portal shared across services — exposing roughly 150 applications, of which the attacker consulted seven — and enabled access to applications that were not protected by stronger factors. Nuñez told senators that applications already protected by MFA were attempted but not successfully penetrated. The initial failure was a chain: mailbox compromise, poor handling of application passwords in email, reuse of credentials to internal applications, then selective querying and extraction from sensitive police systems.","taken":"TAJ contains around 19 million files, but the attacker did not export all of them. The minister said 72 complete TAJ files were exfiltrated, together with tens of thousands of summary or index lines containing identity information but not the reason for a person’s TAJ listing. For FPR, 23 complete files and around 3,000 summary elements were extracted. Ten Interpol files were viewed and one was exfiltrated. These quantities are operational record counts, not a clean number of unique natural persons.","notTaken":"The minister said there was no extraction of millions of complete police records and no ransom demand. No destruction or modification of the police files was reported. An HR application available through the portal was not visited, according to the later hearing.","impact":"The sensitivity of even a small number of full police records is extreme. They can contain investigative, law-enforcement or personal information whose disclosure may affect witnesses, suspects, officers or active operations. Index rows can also be damaging because identity data from a police context can enable targeting or intimidation. The incident also showed that a hardened central database can still be exposed through weaker identity practices on surrounding systems.","response":"The ministry opened a criminal investigation, arrested a suspect on 17 December, reset administrative messaging passwords, removed roughly a thousand accounts belonging to departed personnel, worked with ANSSI on retrospective hunting and log review, and expanded MFA. Nuñez said MFA would be generalised across ministry applications, and the ministry reviewed access profiles and messaging practices.","methodDisclosure":"partial","attackerClaim":"A group using the name Indra claimed access to data on more than 16 million people and associated the figure with police files. That number closely resembled the size of TAJ rather than the amount later shown to have been extracted. The 16.4 million claim remains disputed attacker marketing, not a confirmed person count.","revision":"The first public account of “dozens of files” was reasonable immediately after the December disclosure. The January Senate hearing supplies the precise categories and counts disclosed by the minister, while a unique-person total remains unknown and the 16.4 million claim stays outside the numeric affected field.","quotes":[{"text":"What happened is very serious","original":"Ce qui s’est passé est très grave","originalLang":"fr","attribution":"Laurent Nuñez","sourceId":"interiorAssemblee"},{"text":"digital hygiene","original":"hygiène numérique","originalLang":"fr","attribution":"Laurent Nuñez, Senate hearing","sourceId":"interiorSenate"}]}},{"id":"eurofiber","date":"2025-11-13","year":2025,"org":"Eurofiber France","domain":"eurofiber.com","kind":"company","sector":"Telecom / cloud supplier","sectorLabel":"Telecom / cloud supplier","severity":"high","status":"confirmed","affected":null,"affectedLabel":"Customer scope not expressed as a verified person count","data":"Identification data, hashed passwords, ticket content and some attachments. Banking or critical data and network/cloud integrity were not compromised, Eurofiber said.","method":"Blind SQL injection against the user database, then REST-API exfiltration of tickets and documents.","risk":"Supplier ticketing data can expose configuration and support history about many downstream organisations.","confidence":"Official company post-incident disclosure","sourceName":"Eurofiber France","sourceId":"eurofiber","sourceUrl":"https://www.eurofiber.com/fr-fr/actualites/incident-de-cybersecurite-du-13-novembre-enseignements-et-actions-engagees","sourceIds":["eurofiberInitial","eurofiber","eurofiberCloud"],"lastResearched":"2026-08-16","url":"/incident/eurofiber","detail":{"lead":"Eurofiber France published a detailed postmortem of an incident affecting its customer ticketing platform for Eurofiber France and regional brands, plus the ATE / Eurofiber Cloud Infra France customer portal. The company traced the first activity to 6 November 2025, when the attacker used blind SQL injection against the user database. From 10 November, exfiltration intensified through REST API calls targeting tickets and documents. Monitoring detected anomalies on 13 November at 14:49.","timeline":[{"date":"2025-11-06","label":"Earliest traces identified later: blind SQL injection targeting the user database."},{"date":"2025-11-10","label":"Exfiltration intensifies through REST API calls targeting tickets and documents."},{"date":"2025-11-13","label":"Monitoring detects abnormal activity at 14:49. Crisis response begins. Eurofiber reports the vulnerability patched and the affected server isolated by 18:15."}],"how":"Eurofiber states that a vulnerability in the ticketing software, known in the security community under a CVE reference, permitted SQL injection and API-based data extraction. A customised version in Eurofiber’s environment had not been identified by the vendor as vulnerable. The company did not name the product or the CVE identifier in its own postmortem; this record does not treat a later product name as confirmed.","taken":"Identification data such as name, first name, email, hashed password and, where present, phone or profile information. Ticket content, ticket exchanges and some attachments were also affected. Eurofiber said only about 2 percent of the oldest tickets had attachments in the affected category. The scope included Eurofiber France and regional brands Eurafibre, FullSave, Netiwan and Avelia, plus the Eurofiber Cloud Infra France portal. Customers outside France were reported unaffected.","notTaken":"Eurofiber said banking or critical data were not compromised. It also said the integrity and availability of the underlying network and cloud services were not compromised by the attack.","impact":"The direct service impact was limited, but the downstream intelligence value is significant. A supplier’s support tickets can expose hostnames, architecture details, troubleshooting logs, screenshots and attachments about many organisations at once. This is a supplier-exposure case even without a large public victim count.","response":"Eurofiber activated a crisis cell with its SOC provider, preserved forensic evidence, isolated and patched the vulnerable service, rotated passwords and API keys, tightened IP restrictions, notified customers and authorities, and introduced stronger authentication and API-token protection. The company also reported an extortion attempt in its follow-up.","methodDisclosure":"disclosed","revision":"The postmortem justifies treating the exploitation mechanism — SQL injection and REST-API exfiltration — as disclosed, while still leaving the attacker’s identity and any later product name unconfirmed by Eurofiber.","quotes":[{"text":"The first traces of the attack date back to November 6","original":"The first traces of the attack date back to November 6","originalLang":"en","attribution":"Eurofiber France post-incident review","sourceId":"eurofiber"},{"text":"SQL injection","original":"injection SQL","originalLang":"fr","attribution":"Eurofiber France","sourceId":"eurofiber"}]}},{"id":"weda","date":"2025-11-10","year":2025,"org":"Weda","domain":"weda.fr","kind":"company","sector":"Healthcare","sectorLabel":"Healthcare","severity":"critical","status":"confirmed","affected":null,"affectedLabel":"23,000 health professionals operationally locked out; patient count unknown","data":"Cross-tenant patient-data risk via API. Patient count unknown; 23,000 is operational lockout of health professionals.","method":"Authenticated customer accounts plus a cross-tenant API authorisation weakness.","risk":"Patient-care disruption plus potential exposure of highly sensitive health information.","confidence":"WEDA’s CNIL-notification material; patient count still under investigation.","sourceName":"WEDA","sourceId":"wedaCnil","sourceUrl":"https://assistance.weda.fr/hubfs/2025-11_Notification%20violation%20CNIL%20WEDA.pdf","sourceIds":["wedaCnil","wedaCnilDirect","wedaLemonde","weda","wedaCaducee","wedaAvec"],"lastResearched":"2026-08-16","url":"/incident/weda","detail":{"lead":"WEDA’s own material prepared to help customers complete CNIL breach notifications states that monitoring detected an abnormal activity spike at 17:00 on 10 November 2025 on a customer account making many API calls. Once a user was authenticated to a WEDA customer account, the API could return patient data even when those patients were not attached to that healthcare professional’s account.\n\nAround 23,000 health professionals lost normal access when WEDA shut the application at 23:00. That figure is operational lockout, not a patient count. WEDA classified the event as a confidentiality loss and listed patients as the affected category, while stating that the approximate number of records and people was still under investigation.","timeline":[{"date":"2025-11-10","label":"17:00: abnormal API activity on a customer account. A second account shows the same pattern around 21:00. At 23:00 WEDA shuts the application for all users."},{"date":"2025-11-11","label":"CNIL says it has been informed of the WEDA data breach from this date."},{"date":"2025-11-12","label":"WEDA mobilises forensic support, files a complaint with the Police nationale, and begins exchanges with ANSSI."},{"date":"2025-11-14","label":"Partial access resumes. Login plus password alone is no longer sufficient; Pro Santé Connect or CPx is required, and vulnerable endpoints are decommissioned."}],"how":"The suspicious activity came through authenticated customer accounts. The relevant API had an authorisation-boundary problem: a connected customer account could query patient data not attached to that professional. That is a failure of authorisation after a valid session, not merely an unspecified server intrusion. The material does not establish how the attacker obtained control of the customer accounts — phishing, credential stuffing, account reuse or another technique is not proven. WEDA labelled the cause as an external malicious act in the hacking, malware or phishing category for CNIL notification.","taken":"WEDA’s primary material says the API could call patient data stored in WEDA databases across customer boundaries. It instructs customer organisations to classify the affected category as patients and says the approximate number of records and persons remained under investigation. That supports a patient-data confidentiality-breach risk. It does not support inventing a national patient count. The 23,000 figure is the number of health professionals operationally affected by the shutdown.","notTaken":"No reliable public final total of affected patient records was found. The evidence does not establish mass export of all WEDA patient records. Local providers who later told their own patients that their specific practice had not identified health data as compromised should not be generalised into a claim that no WEDA patient data anywhere was accessed.","impact":"The outage immediately disrupted care workflows. Clinicians temporarily worked without normal electronic access to histories, prescriptions, correspondence and billing tools, sometimes reverting to paper and asking patients to bring recent documents. The confidentiality risk is unusually serious because the system stores health information. Even unauthorised access to a smaller subset of medical data can create significant privacy and discrimination risks.","response":"WEDA shut the service, disabled suspicious accounts, blocked source IP addresses, brought in forensic support, contacted ANSSI, filed a police complaint and supported CNIL notification. Before reopening, it reviewed Pro Santé Connect, tightened source-IP restrictions, decommissioned vulnerable endpoints, and restricted professional login to stronger healthcare authentication methods during the degraded recovery period.","methodDisclosure":"disclosed","revision":"An unspecified intrusion is too vague given WEDA’s later primary document. The public record now supports authenticated customer accounts used to call APIs, an API that could return patient data outside the customer’s own scope, and a confidentiality breach. The affected patient count still remains unknown.","quotes":[{"text":"an abnormal activity spike","original":"un pic d’activité anormal","originalLang":"fr","attribution":"WEDA CNIL-notification material","sourceId":"wedaCnil"},{"text":"loss of confidentiality","original":"Perte de la confidentialité","originalLang":"fr","attribution":"WEDA CNIL-notification material","sourceId":"wedaCnil"},{"text":"still under investigation","original":"toujours en cours d’investigation","originalLang":"fr","attribution":"WEDA CNIL-notification material","sourceId":"wedaCnil"}]}},{"id":"airfrance","date":"2025-08-06","year":2025,"org":"Air France / KLM","domain":"airfrance.com","kind":"company","sector":"Aviation","sectorLabel":"Aviation","severity":"high","status":"confirmed","affected":null,"affectedLabel":"Number not publicly disclosed","data":"Names, contact details, Flying Blue number and status, and subjects of customer-service requests. Passwords, travel data, passport and card numbers were reported unaffected.","method":"Unauthorised access to a third-party customer-service platform; the vendor is unnamed.","risk":"Highly believable phishing and impersonation using real loyalty and support context.","confidence":"Confirmed by the airlines; customer count unpublished; any Salesforce link is unconfirmed.","sourceName":"KLM","sourceId":"airfranceKlm","sourceUrl":"https://nieuws.klm.com/klm-informeert-klanten-over-incident-met-persoonsgegevens/","sourceIds":["airfranceKlm","airfrance","airfranceBleeping","airfranceSecurityweek"],"lastResearched":"2026-08-16","url":"/incident/airfrance","detail":{"lead":"Air France and KLM disclosed in early August 2025 that an external platform used for customer service had been accessed without authorisation. They stressed that the compromised environment was a third-party customer-service platform, not their core airline networks. The number of customers was never publicly disclosed.","timeline":[{"date":"2025-08-06","label":"Air France and KLM begin public notification of unauthorised access to an external customer-service platform."},{"date":"2025-08-07","label":"Security press reports the breach and confirms the companies will not disclose the victim count while the investigation is active."}],"how":"The airlines confirmed that the unauthorised activity occurred on an external platform used by their contact centres and said their own networks were not affected. They did not publicly name the vendor. Security reporting connected the incident to a broader campaign against third-party CRM services; BleepingComputer asked whether Salesforce was involved and the company declined to confirm. The vendor and any social-engineering path remain unconfirmed by Air France-KLM.","taken":"Names, contact information, Flying Blue membership number and status, and the subject of requests made to customer service. Some notices also referred to notes connected with those interactions. That combination can let a fraudster construct highly plausible messages that refer to a real loyalty account and a genuine prior support issue.","notTaken":"The airlines said passwords, passport numbers, payment-card information, travel itineraries and Flying Blue mileage balances were not affected. Core Air France and KLM networks were also described as unaffected.","impact":"The direct operational impact appears limited compared with incidents that took production systems offline. The primary risk is fraud: an attacker can use real support history and loyalty information to impersonate an airline, claim a booking or account issue, or attempt credential theft through a fake support flow.","response":"The companies and the external provider cut off the unauthorised access, took measures intended to prevent recurrence, notified data-protection authorities — Air France the CNIL, KLM the Dutch authority — and contacted affected customers. Customers were warned about suspicious email and telephone contact.","methodDisclosure":"partial","revision":"The original account remains broadly accurate. The victim count is unknown, and a possible Salesforce connection is not company-confirmed.","quotes":[{"text":"unusual activity on an external platform we use for customer service","original":"unusual activity on an external platform we use for customer service","originalLang":"en","attribution":"Air France-KLM statement, in English","sourceId":"airfranceBleeping"},{"text":"direct action to stop the unauthorized access","original":"direct action to stop the unauthorized access","originalLang":"en","attribution":"KLM customer communication, English rendering","sourceId":"airfranceKlm"}]}},{"id":"bouygues","date":"2025-08-04","year":2025,"org":"Bouygues Telecom","domain":"bouyguestelecom.fr","kind":"company","sector":"Telecommunications","sectorLabel":"Telecommunications","severity":"critical","status":"confirmed","affected":6400000,"affectedLabel":"6.4 million customer accounts","data":"Identity, contact, contract data and BIC/IBAN on 6.4 million customer accounts — not a unique-person count. Passwords and cards not exposed.","method":"Unauthorised access; the initial access route has not been published.","risk":"Targeted impersonation and direct-debit scams. An IBAN is not online-banking access.","confidence":"Official company disclosure","sourceName":"Bouygues Telecom","sourceId":"bouygues","sourceUrl":"https://www.corporate.bouyguestelecom.fr/archives-communique-presse/bouygues-telecom-annonce-avoir-ete-victime-dune-cyberattaque/","sourceIds":["bouygues","bouyguesFaq","bouyguesCybermalveillance","bouyguesLemonde","bouyguesTechcrunch"],"lastResearched":"2026-08-16","url":"/incident/bouygues","detail":{"lead":"Bouygues Telecom detected a cyberattack on 4 August 2025 and disclosed it two days later. The intrusion gave unauthorised access to personal data linked to 6.4 million customer accounts. That figure is a count of accounts, not necessarily 6.4 million unique people. Exposed fields included contact and civil-status information, contract information and banking identifiers such as BIC and IBAN. Bouygues said account passwords and payment-card numbers were not exposed.","timeline":[{"date":"2025-08-04","label":"Bouygues Telecom detects the attack; technical teams stop the unauthorised access."},{"date":"2025-08-06","label":"Public disclosure: 6.4 million accounts; CNIL notified; complaint filed; customer notification begins."},{"date":"2025-08-13","label":"Bouygues and Cybermalveillance.gouv.fr publish practical guidance on phishing, IBAN-related fraud and direct-debit disputes."},{"date":"2026-02-04","label":"Cybermalveillance.gouv.fr updates its public advice page, preserving the 6.4 million-account scope and fraud guidance."}],"how":"Bouygues has described the event as unauthorised access and said its technical teams stopped it. The company has not publicly identified the initial access vector, a vulnerability, or an attacker.","taken":"Customer contact details, civil-status information, contract data, and BIC/IBAN. Cybermalveillance’s public summary also notes company identity and SIREN for relevant professional records. The 6.4 million figure is a count of customer accounts, not necessarily 6.4 million unique natural persons.","notTaken":"Bouygues said customer account passwords and payment-card numbers were not exposed. Possession of an IBAN does not equal possession of bank credentials and does not automatically allow an attacker to move money.","impact":"The durable risk is targeted impersonation. A scammer who knows a victim’s operator, identity, contract context and IBAN can convincingly pose as a telecom employee, bank fraud unit, debt collector or payment intermediary. The exposure can also support fraudulent direct-debit attempts, although banks provide dispute mechanisms for unauthorised debits.","response":"Bouygues contained the unauthorised access, notified the CNIL, filed a criminal complaint and informed affected customers by email or SMS. Its FAQ explained what an IBAN can and cannot enable and referred customers to their bank when suspicious activity appears. Cybermalveillance.gouv.fr published public guidance designed to reduce follow-on fraud.","methodDisclosure":"undisclosed","revision":"The confirmed 6.4 million number is customer accounts, and the presence of IBAN data should not be described as a compromise of online banking.","quotes":[{"text":"unauthorized access to certain personal data of 6.4 million customer accounts","original":"accès non autorisé à certaines données personnelles de 6,4 millions de comptes clients","originalLang":"fr","attribution":"Bouygues Telecom","sourceId":"bouygues"}]}},{"id":"orange","date":"2025-07-25","year":2025,"org":"Orange","domain":"orange.com","kind":"company","sector":"Telecommunications","sectorLabel":"Telecommunications","severity":"high","status":"confirmed","affected":null,"affectedLabel":"Limited business-related files later acknowledged stolen; no customer-person count","data":"Later acknowledged: limited old or low-sensitivity business-related files. No confirmed consumer-database theft.","method":"Cyberattack on an information system; the initial access route has not been published.","risk":"Service disruption, then reconnaissance and phishing risk from leaked business files.","confidence":"Official disclosure, later qualified by a spokesperson. WarLock is press reporting, not Orange attribution.","sourceName":"Orange","sourceId":"orange","sourceUrl":"https://newsroom.orange.com/the-orange-group-announces-that-it-filed-a-complaint-on-monday-28-july-concerning-a-security-incident-on-one-of-its-information-systems/?lang=eng","sourceIds":["orange","orangeFollowup","orange01net"],"lastResearched":"2026-08-16","url":"/incident/orange","detail":{"lead":"Orange detected a cyberattack on one of its information systems on 25 July 2025. Isolating potentially affected services interrupted some business-management platforms and several consumer-facing services, mainly in France. On 28 July the company said it had found no evidence that Orange or customer data had been exfiltrated.\n\nThat first conclusion did not hold. In August, material attributed to the intrusion appeared on a criminal leak site. Orange then acknowledged limited access and that old or low-sensitivity information concerning business customers had been taken. No verified customer-person count has been published. A separate Orange Belgium event affecting about 850,000 accounts is not this incident.","timeline":[{"date":"2025-07-25","label":"Orange detects a cyberattack on one information system."},{"date":"2025-07-28","label":"Public disclosure: services isolated, complaint filed, no evidence of exfiltration at that stage."},{"date":"2025-07-30","label":"Initial recovery target for the principal disrupted services, under heightened monitoring."},{"date":"2025-08-25","label":"ZDNet and then 01net report that Orange has acknowledged limited access and theft of old or low-sensitivity business-related information."}],"how":"Orange has not published an initial-access vector. Isolation of potentially affected services caused part of the visible outage. Later security reporting characterised the event as a ransomware or extortion incident associated with WarLock on the basis of leak-site activity; that is reporting, not a formal attribution by Orange.","taken":"Later reporting, quoting an Orange spokesperson, described stolen material as old or low-sensitivity data related to business customers, obtained through only limited access. ZDNet reported that seven internal documents appeared on the leak site. There is still no public, verified number of individuals affected by this France incident.","notTaken":"Orange did not confirm theft of passwords, payment-card data, or a French consumer customer database in this incident. The Orange Belgium breach disclosed later in August is a separate event and is not counted here.","impact":"The immediate impact was operational: disruption to business-management services and some consumer services while systems were isolated. The secondary impact was trust and disclosure risk, because the public account evolved from no evidence of exfiltration to an acknowledged limited leak. Even old operational documents can aid reconnaissance, impersonation, supplier fraud and follow-on phishing.","response":"Orange Cyberdefense isolated affected or potentially affected services, Orange filed a complaint, and authorities were notified. Services were progressively restored under enhanced monitoring. After data appeared publicly, Orange said affected companies had been informed before publication and that it was cooperating with them and the competent authorities.","methodDisclosure":"undisclosed","attackerClaim":"Reporting linked a leak-site publication of about 4 GB to the WarLock extortion operation. Orange did not publish a formal attacker attribution, and the claimed volume is not a victim count.","revision":"The 28 July statement was accurate only as a statement of what the company knew then. A durable record has to preserve the later revision: Orange initially found no evidence of exfiltration, then acknowledged that a limited set of older or low-sensitivity business-related data had been stolen and published. The scope of affected people remains unknown.","quotes":[{"text":"isolate the potentially affected services and limit the impact","original":"isoler les services potentiellement concernés et limiter les impacts","originalLang":"fr","attribution":"Orange, 28 July 2025","sourceId":"orange"},{"text":"limited access","original":"un accès limité","originalLang":"fr","attribution":"Orange spokesperson, reported by 01net","sourceId":"orange01net"},{"text":"old or low-sensitivity data","original":"des données obsolètes ou de faible sensibilité","originalLang":"fr","attribution":"Orange spokesperson, reported by 01net","sourceId":"orange01net"}]}}]}