{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"incident":{"id":"ficoba","date":"2026-01-31","year":2026,"org":"DGFiP / FICOBA","domain":"economie.gouv.fr","kind":"government","sector":"Finance / tax","sectorLabel":"Finance / tax","severity":"critical","status":"confirmed","affected":1200000,"affectedLabel":"About 1.2 million bank accounts","data":"Bank-account identifiers (RIB/IBAN), account-holder identity and postal address. The tax identifier was not consulted. No balances.","method":"Stolen credentials of a civil servant outside DGFiP, authorised for inter-ministry queries — not a FICOBA software flaw.","risk":"Targeted bank and tax phishing, identity fraud and fake-adviser scams.","confidence":"Official government disclosure and later parliamentary answers","sourceName":"French Finance Ministry","sourceId":"ficoba","sourceUrl":"https://presse.economie.gouv.fr/acces-illegitimes-au-fichier-national-des-comptes-bancaires-ficoba/","sourceIds":["ficoba","ficobaFaqPage","ficobaImpots","ficobaQ13230","ficobaQ13370"],"lastResearched":"2026-08-16","url":"/incident/ficoba","detail":{"lead":"From late January through 13 February 2026, an attacker used credentials belonging to a civil servant outside DGFiP who was authorised to query FICOBA for inter-ministry information exchange. About 1.2 million bank-account records — less than 1 percent of the register — were consulted or extracted.\n\nThe 1.2 million figure refers to bank accounts, not unique people. One person can hold more than one account, and one account can have several holders.","timeline":[{"date":"2026-01-28","label":"Illegitimate FICOBA consultations begin using the credentials of an authorised civil servant outside DGFiP."},{"date":"2026-02-13","label":"Last day of the illegitimate access window stated in later parliamentary answers."},{"date":"2026-02-16","label":"DGFiP makes its first CNIL notification, according to a later parliamentary response."},{"date":"2026-02-18","label":"Finance Ministry publicly discloses the incident and the approximately 1.2 million-account scope."},{"date":"2026-02-23","label":"DGFiP supplements its CNIL notification."},{"date":"2026-02-24","label":"Banks begin receiving securely transmitted information about their accounts in the consulted set."},{"date":"2026-04-28","label":"Parliamentary answer: the compromised account belonged to another administration, not a FICOBA software exploit."}],"how":"The attack used valid credentials attached to an authorised inter-ministry user outside DGFiP. The government has not published how those credentials were stolen. A parliamentary response states that the incident resulted from use of an account in a third administration and was not the result of a software vulnerability in FICOBA itself.","taken":"Bank-account identifiers such as RIB and IBAN, account-holder identity and postal address. The Finance Ministry said the tax identifier was not consulted during the illegitimate access.","notTaken":"FICOBA does not contain account balances or transaction history. The incident did not compromise bank passwords, impots.gouv.fr passwords or access to taxpayers’ secured tax spaces. An IBAN is sensitive for fraud, but it is not a credential that grants online-banking control.","impact":"The most credible downstream harms are targeted bank and tax phishing, identity fraud and attempts to create unauthorised direct debits. The combination of a real identity, address and IBAN is especially useful for a fake-bank adviser or administrative impersonation scam.","response":"DGFiP restricted external access, worked with ANSSI and ministry security officials, notified the CNIL, filed a complaint, contacted affected users, and provided banks with account-level information so they could strengthen monitoring and customer warnings. Later parliamentary responses say external access remained cut while security work continued.","methodDisclosure":"disclosed","revision":"Later parliamentary material confirms the first public account and adds the security-boundary finding: the compromised credentials belonged to a civil servant outside DGFiP, and the incident was not a FICOBA software exploit.","quotes":[{"text":"impersonated or used a civil servant’s credentials","original":"usurpé les identifiants d’un fonctionnaire","originalLang":"fr","attribution":"French Finance Ministry, 18 February 2026","sourceId":"ficoba"},{"text":"1.2 million accounts","original":"1,2 millions de comptes","originalLang":"fr","attribution":"French Finance Ministry, 18 February 2026","sourceId":"ficoba"}]}},"source":{"id":"ficoba","name":"French Finance Ministry - FICOBA illegal access","url":"https://presse.economie.gouv.fr/acces-illegitimes-au-fichier-national-des-comptes-bancaires-ficoba/","publisher":"Ministry of Finance","kind":"primary","published":"2026-02-18"},"sources":[{"id":"ficoba","name":"French Finance Ministry - FICOBA illegal access","url":"https://presse.economie.gouv.fr/acces-illegitimes-au-fichier-national-des-comptes-bancaires-ficoba/","publisher":"Ministry of Finance","kind":"primary","published":"2026-02-18"},{"id":"ficobaFaqPage","name":"Ministry of Economy — FICOBA, what to know","url":"https://www.economie.gouv.fr/actualites/ficoba-tout-savoir-lacces-illegitime-au-fichier-national-des-comptes-bancaires","publisher":"Ministry of Economy and Finance","kind":"primary","published":"2026-03-03"},{"id":"ficobaImpots","name":"impots.gouv.fr — FICOBA illegitimate access","url":"https://www.impots.gouv.fr/actualite/acces-illegitimes-au-fichier-national-des-comptes-bancaires-ficoba","publisher":"DGFiP","kind":"primary","published":"2026-02-27"},{"id":"ficobaQ13230","name":"Assemblée nationale — question n°13230 on FICOBA","url":"https://questions.assemblee-nationale.fr/q17/17-13230QE.htm","publisher":"Assemblée nationale","kind":"official","published":"2026-04-28"},{"id":"ficobaQ13370","name":"Assemblée nationale — question n°13370 on FICOBA user support","url":"https://questions.assemblee-nationale.fr/q17/17-13370QE.htm","publisher":"Assemblée nationale","kind":"official","published":"2026-06-09"}]}