{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"incident":{"id":"interior","date":"2025-12-11","year":2025,"org":"French Interior Ministry","domain":"interieur.gouv.fr","kind":"government","sector":"Law enforcement","sectorLabel":"Law enforcement","severity":"critical","status":"disputed","affected":null,"affectedLabel":"72 TAJ files and tens of thousands of TAJ index rows; 23 FPR files and ~3,000 FPR index elements; 1 Interpol file — not a person count","data":"72 full TAJ files plus tens of thousands of TAJ index rows; 23 FPR files plus ~3,000 FPR index elements; 1 Interpol file after 10 viewed. Not a person count.","method":"Compromised police mailboxes, then application passwords found in email, then a police portal. MFA stopped apps that already had it.","risk":"Exceptionally sensitive law-enforcement information, potential danger to individuals, investigations and operational security.","confidence":"Senate reconstruction of a confirmed breach; 16.4 million remains an attacker claim.","sourceName":"Sénat","sourceId":"interiorSenate","sourceUrl":"https://www.senat.fr/compte-rendu-commissions/20260112/lois.html","sourceIds":["interiorSenate","interiorSenateNews","interiorAssemblee","interiorPublicSenat","interior","interiorFrance24"],"lastResearched":"2026-08-16","url":"/incident/interior","detail":{"lead":"A criminal actor claimed access to data on more than 16 million people. The interior minister later rejected the idea that millions of complete records had been extracted. A Senate hearing on 13 January 2026 reconstructed a narrower, still serious scope: 72 full TAJ files plus tens of thousands of TAJ index rows, 23 FPR files plus about 3,000 FPR index elements, and 1 Interpol file exfiltrated after 10 were viewed. Those quantities are operational record counts, not a unique-person total.\n\nThe path ran from compromised professional mailboxes, through application passwords that agents had exchanged in email, to a Police nationale portal. Applications that already had MFA were attempted but not successfully penetrated.","timeline":[{"date":"2025-11-25","label":"DGPN notices that passwords to several police mailboxes have been changed."},{"date":"2025-11-28","label":"Services reset mailbox passwords themselves."},{"date":"2025-12-08","label":"The ministry knows that an unauthorised person has accessed a Police nationale portal and several applications. A criminal investigation is opened."},{"date":"2025-12-17","label":"Minister Laurent Nuñez publicly confirms access to TAJ and FPR and extraction of dozens of confidential files. A 22-year-old suspect is arrested."},{"date":"2026-01-13","label":"Nuñez gives the Senate the 72 TAJ, 23 FPR and Interpol figures, and describes MFA remediation."}],"how":"Compromised professional mailboxes gave the attacker access to messages in which some agents had exchanged passwords for internal applications. Those credentials opened a police portal shared across services — exposing roughly 150 applications, of which the attacker consulted seven — and enabled access to applications that were not protected by stronger factors. Nuñez told senators that applications already protected by MFA were attempted but not successfully penetrated. The initial failure was a chain: mailbox compromise, poor handling of application passwords in email, reuse of credentials to internal applications, then selective querying and extraction from sensitive police systems.","taken":"TAJ contains around 19 million files, but the attacker did not export all of them. The minister said 72 complete TAJ files were exfiltrated, together with tens of thousands of summary or index lines containing identity information but not the reason for a person’s TAJ listing. For FPR, 23 complete files and around 3,000 summary elements were extracted. Ten Interpol files were viewed and one was exfiltrated. These quantities are operational record counts, not a clean number of unique natural persons.","notTaken":"The minister said there was no extraction of millions of complete police records and no ransom demand. No destruction or modification of the police files was reported. An HR application available through the portal was not visited, according to the later hearing.","impact":"The sensitivity of even a small number of full police records is extreme. They can contain investigative, law-enforcement or personal information whose disclosure may affect witnesses, suspects, officers or active operations. Index rows can also be damaging because identity data from a police context can enable targeting or intimidation. The incident also showed that a hardened central database can still be exposed through weaker identity practices on surrounding systems.","response":"The ministry opened a criminal investigation, arrested a suspect on 17 December, reset administrative messaging passwords, removed roughly a thousand accounts belonging to departed personnel, worked with ANSSI on retrospective hunting and log review, and expanded MFA. Nuñez said MFA would be generalised across ministry applications, and the ministry reviewed access profiles and messaging practices.","methodDisclosure":"partial","attackerClaim":"A group using the name Indra claimed access to data on more than 16 million people and associated the figure with police files. That number closely resembled the size of TAJ rather than the amount later shown to have been extracted. The 16.4 million claim remains disputed attacker marketing, not a confirmed person count.","revision":"The first public account of “dozens of files” was reasonable immediately after the December disclosure. The January Senate hearing supplies the precise categories and counts disclosed by the minister, while a unique-person total remains unknown and the 16.4 million claim stays outside the numeric affected field.","quotes":[{"text":"What happened is very serious","original":"Ce qui s’est passé est très grave","originalLang":"fr","attribution":"Laurent Nuñez","sourceId":"interiorAssemblee"},{"text":"digital hygiene","original":"hygiène numérique","originalLang":"fr","attribution":"Laurent Nuñez, Senate hearing","sourceId":"interiorSenate"}]}},"source":{"id":"interiorSenate","name":"Sénat — Commission des lois, audition de Laurent Nuñez","url":"https://www.senat.fr/compte-rendu-commissions/20260112/lois.html","publisher":"Sénat","kind":"official","published":"2026-01-13"},"sources":[{"id":"interiorSenate","name":"Sénat — Commission des lois, audition de Laurent Nuñez","url":"https://www.senat.fr/compte-rendu-commissions/20260112/lois.html","publisher":"Sénat","kind":"official","published":"2026-01-13"},{"id":"interiorSenateNews","name":"Sénat — Audition de Laurent Nuñez","url":"https://www.senat.fr/actualite/audition-de-laurent-nunez-6388.html","publisher":"Sénat","kind":"official","published":"2026-01-13"},{"id":"interiorAssemblee","name":"Assemblée nationale — séance du 17 décembre 2025","url":"https://questions.assemblee-nationale.fr/dyn/17/comptes-rendus/seance/session-ordinaire-de-2025-2026/premiere-seance-du-mercredi-17-decembre-2025","publisher":"Assemblée nationale","kind":"official","published":"2025-12-17"},{"id":"interiorPublicSenat","name":"Public Sénat — MFA after the Interior Ministry intrusion","url":"https://www.publicsenat.fr/actualites/politique/cyberattaque-contre-le-ministere-de-linterieur-laurent-nunez-va-generaliser-la-double-identification-pour-lacces-aux-applications","publisher":"Public Sénat","kind":"secondary","published":"2026-01-13"},{"id":"interior","name":"Le Monde — Interior Ministry databases pirated","url":"https://www.lemonde.fr/en/pixels/article/2025/12/17/hackers-pirate-french-interior-ministry-databases_6748599_13.html","publisher":"Le Monde","kind":"secondary","published":"2025-12-17"},{"id":"interiorFrance24","name":"France 24 — Interior Ministry, tens of files extracted","url":"https://www.france24.com/fr/info-en-continu/20251217-des-dizaines-de-fichiers-sensibles-du-ministere-de-l-interieur-voles-lors-dune-attaque-informatique","publisher":"France 24","kind":"secondary","published":"2025-12-17"}]}