{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en","total":6,"returned":6,"offset":0,"limit":100,"withoutPublishedCount":3},"incidents":[{"id":"dgfip","date":"2026-08-14","year":2026,"org":"DGFiP tax systems","domain":"economie.gouv.fr","kind":"government","sector":"Finance / tax","sectorLabel":"Finance / tax","severity":"critical","status":"confirmed","affected":678000,"affectedLabel":"678,000 individuals and businesses","data":"Tax data including reference income, household quotient and withholding rate; business name/SIREN. Cadastral data also consulted. User tax-space passwords not compromised.","method":"Stolen credentials of a DGFiP agent and an authorised third party.","risk":"Highly persuasive tax and wealth-targeted scams using real fiscal circumstances.","confidence":"Official government disclosure; investigation ongoing","sourceName":"French Finance Ministry","sourceId":"dgfip","sourceUrl":"https://presse.economie.gouv.fr/acces-illegitime-au-systeme-dinformation-de-la-direction-generale-des-finances-publiques/","sourceIds":["dgfip","dgfipLemonde","dgfipBriefing","dgfipEntrevue"],"lastResearched":"2026-08-16","url":"/incident/dgfip","detail":{"lead":"The DGFiP confirmed on 14 August 2026 that two illegitimate-access incidents in June and July had relied on stolen or impersonated credentials belonging to a DGFiP agent and an authorised third party. When the intrusions were detected, access to the implicated accounts was cut. At that time, however, the access-control review did not identify that data had already been stolen.\n\nThe decisive trigger came on 12 and 13 August, when a malicious actor publicly claimed the intrusions. DGFiP then matched the claims against its logs and established that data concerning a total of 678,000 individuals and businesses had been consulted and extracted before access was terminated.","timeline":[{"date":"2026-06-30","label":"A DGFiP agent account is compromised or impersonated (late June). Access is detected and cut. Data theft is not identified at that moment."},{"date":"2026-07-15","label":"A second illegitimate-access incident occurs in July using credentials of an authorised third party, according to the Finance Ministry’s later statement (exact day not published)."},{"date":"2026-08-12","label":"A malicious actor publicly claims access. DGFiP begins deeper investigation against historical logs."},{"date":"2026-08-13","label":"A further claim or disclosure is made by the malicious actor."},{"date":"2026-08-14","label":"Finance Ministry confirms 678,000 individuals and businesses in the established extracted or consulted scope. User tax-space credentials are said to be unaffected."},{"date":"2026-08-16","label":"French reporting says the Paris prosecutor’s cyber section has opened an investigation and entrusted it to OFAC."},{"date":"2026-08-17","label":"DGFiP plans to contact each affected individual or business from the week of 17 August, with details of the data that may have been consulted or extracted."}],"how":"The official account says the incidents rested on credential impersonation: one DGFiP agent and one authorised third party. The Finance Ministry has not publicly supplied the complete authentication architecture or confirmed the attacker’s claims about specific remote-access products. DGFiP said the theft was missed during the initial response because the attack was sophisticated. Press reporting based on a briefing by director-general Amélie Verdier adds that extraction was slow or broken into patterns that did not look like obvious bulk querying.","taken":"The written government statement sets the confirmed combined scope at 678,000 individuals and businesses. It lists reference taxable income, household quotient, withholding-tax rate, business name and SIREN, plus cadastral information relating to addresses and property surface areas.\n\nPress briefing coverage separately reported a cadastral consultation involving around 200,000 accounts. The 14 August written release does not establish that as a second additive victim population, so it is not added to the 678,000.","notTaken":"The Finance Ministry said individual and business Finances publiques spaces were not compromised and that user identifiers and passwords for those spaces were not compromised. Stolen tax data can make fraud extremely convincing, but it does not itself provide a login to a taxpayer’s secured account.","impact":"This is one of the highest-risk identity datasets in the collection because it reveals both personal identity and financial circumstances. A scammer who knows a victim’s reference income, household quotient and withholding rate can convincingly impersonate the tax authority, a bank, accountant or wealth-management service. For high-income households, disclosure may also create targeting and physical-security concerns that go beyond ordinary email phishing.","response":"DGFiP cut access associated with the compromised accounts, then made additional preventive cuts to sensitive information systems after the August discoveries. It notified the CNIL, worked with SHFDS and ANSSI, planned individual notification, and announced a criminal complaint. Reporting on 16 August said a Paris prosecutor investigation had been opened with OFAC.","methodDisclosure":"disclosed","revision":"This case was still evolving at the research cutoff. Criminal posts described a VPN and made additional claims about bypassing authentication controls; those claims remain separate from the official method. The written release also says the exact nature and volume of extracted data and the final number of users concerned were still being investigated, so even the 678,000 figure should be understood as the established scope at 14 August, not necessarily the final endpoint of the inquiry.","quotes":[{"text":"a total of 678,000 individuals and businesses","original":"un total de 678 000 particuliers et professionnels","originalLang":"fr","attribution":"French Finance Ministry, 14 August 2026","sourceId":"dgfip"},{"text":"were not compromised","original":"n’ont pas été compromis","originalLang":"fr","attribution":"French Finance Ministry, 14 August 2026, referring to users’ secured tax spaces and credentials","sourceId":"dgfip"}]}},{"id":"edustaff","date":"2026-07-25","year":2026,"org":"Education Ministry staff system","domain":"education.gouv.fr","kind":"government","sector":"Education","sectorLabel":"Education","severity":"critical","status":"confirmed","affected":null,"affectedLabel":"A “significant number” of agents since 2001; exact count unpublished","data":"Identity and professional data; for some, address, phone and social-security number. No banking, passwords or pupil data.","method":"Impersonation of a professional account.","risk":"Durable identity fraud using social-security numbers and employment context.","confidence":"Official disclosure; headcount still unpublished","sourceName":"French Education Ministry","sourceId":"eduStaff","sourceUrl":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-personnels-de-l-education-nationale-505407","sourceIds":["eduStaff"],"lastResearched":"2026-08-16","url":"/incident/edustaff","detail":{"lead":"The Education Ministry disclosed on 31 July 2026 that a professional account had been impersonated during the night of 25 July, giving fraudulent access to an information system dedicated to staff training. The ministry security operations centre was alerted on 26 July and external access was suspended.\n\nThe system contained identity and professional information about agents who had worked in academies since 2001. The ministry described the potential population only as a significant number of agents. No official quantified update was found before the 16 August research cutoff.","timeline":[{"date":"2026-07-25","label":"Fraudulent access occurs during the night after impersonation of a professional account."},{"date":"2026-07-26","label":"COSSIM is alerted. External access to the system is suspended and a crisis cell is activated."},{"date":"2026-07-31","label":"The ministry publicly discloses the incident and says the exact scope is still under investigation."}],"how":"The ministry describes the mechanism as impersonation of a professional account. It does not disclose how that account was compromised, whether MFA was present, or whether any software flaw was also involved. This is the third major Education Ministry incident in the 2026 dataset and the second whose public core is compromised credentials.","taken":"Potentially exposed information covers identity and professional data, including status and functions, for staff who worked in academies since 2001. For some records, postal address, phone number and social-security number are also present. Because the exact number remains unknown, no numeric value is used in aggregate charts.","notTaken":"The ministry explicitly states that the system does not contain banking data, passwords or pupil data.","impact":"Social-security numbers and long-lived identity information create durable fraud risk. Unlike a password, a social-security identifier is not something a person can simply rotate after a breach. Employment role and contact details also support convincing ministry or payroll impersonation.","response":"The ministry suspended external access, activated a crisis cell, filed a complaint, notified ANSSI and CNIL, began checks across its other systems, and said potentially affected staff would be informed. It also reiterated that it had been strengthening security for several months.","methodDisclosure":"partial","revision":"No later official public person count was identified through the 16 August research cutoff. The record does not guess a headcount from the age of the database or the size of the ministry.","quotes":[{"text":"a significant number of its agents","original":"un nombre important de ses agents","originalLang":"fr","attribution":"French Education Ministry, 31 July 2026","sourceId":"eduStaff"},{"text":"the investigations are continuing","original":"les investigations se poursuivent","originalLang":"fr","attribution":"French Education Ministry, 31 July 2026","sourceId":"eduStaff"}]}},{"id":"ants","date":"2026-04-15","year":2026,"org":"France Titres / ANTS","domain":"ants.gouv.fr","kind":"government","sector":"Identity / public services","sectorLabel":"Identity / public services","severity":"critical","status":"confirmed","affected":11700000,"affectedLabel":"About 11.7 million accounts that may be concerned","data":"Login identifier, title, names, email, date of birth and unique account ID; sometimes postal address, place of birth and phone.","method":"Official cause still under investigation.","risk":"Government-themed identity phishing around licences, passports and ID documents.","confidence":"Official update; origin still under investigation","sourceName":"France Titres (ANTS)","sourceId":"ants","sourceUrl":"https://mairie.ants.gouv.fr/toute-l-actualite/incident-de-securite-relatif-au-portail-antsgouvfr-point-detape-du-21-avril-2026","sourceIds":["ants","antsInterior","antsTf1Maintenance","antsLemonde","antsLemondeArrest","antsTf1Breach3d"],"lastResearched":"2026-08-16","url":"/incident/ants","detail":{"lead":"France Titres, also known as ANTS, detected a security incident on 15 April 2026 involving the ants.gouv.fr portal. The 21 April official update said about 11.7 million individual and professional accounts could be concerned.\n\nThat figure is phrased as accounts that may be concerned. It should not automatically be read as 11.7 million complete records definitely downloaded. Criminal claims of roughly 18 to 19 million records are not the official count.","timeline":[{"date":"2026-04-15","label":"ANTS detects the security incident."},{"date":"2026-04-16","label":"ANTS reports to the Paris prosecutor that data presented as coming from the incident is being offered for sale. A cyber investigation begins."},{"date":"2026-04-21","label":"Official update: 11.7 million accounts may be concerned. Technical investigation of origin and scope is still ongoing."},{"date":"2026-04-24","label":"ANTS places the portal into maintenance from 19:30 to continue security strengthening."},{"date":"2026-04-25","label":"A 15-year-old suspect is arrested."},{"date":"2026-04-30","label":"Paris prosecutor publicly announces the arrest and says the minor is suspected of having contributed to the leak."}],"how":"The principal ANTS update does not name an initial-access vector or vulnerability. It says internal technical investigations are working to establish origin and scope. Later journalism described an IDOR-style API weakness; researchers also said they had previously reported security flaws. Those accounts remain reporting unless France Titres, investigators or a judicial record confirms the specific technical path.","taken":"Potentially affected fields include login identifier, civil-status title, surname and given names, email, date of birth and a unique account ID. For some accounts the dataset also includes postal address, place of birth and phone number. ANTS said the disclosed fields by themselves did not allow someone to log into the named ANTS account.","notTaken":"At the 21 April stage, ANTS excluded supporting documents uploaded for administrative procedures and biometric data. Passwords were not listed among the disclosed fields.","impact":"The data is highly suitable for government-themed identity phishing. A fraudster can cite a real date of birth, address or ANTS context and impersonate a driving-licence, passport, registration or identity-document process. The main direct danger is not that the leaked fields themselves unlock the portal, but that they make the next social-engineering step more convincing.","response":"ANTS notified CNIL, referred the matter to the Paris prosecutor, and an OFAC investigation was opened. The Interior Minister asked the Inspection générale de l’administration to establish the chain of responsibility. Professional and individual users were informed. ANTS advised password changes at the next login as a precaution. The portal was later placed in maintenance for additional hardening.","methodDisclosure":"undisclosed","attackerClaim":"Sellers on criminal forums claimed a larger dataset, generally in the 18 to 19 million-record range. Official government communications used 11.7 million accounts as the potential scope. The later arrest of a minor suspected of contributing to the leak does not validate the advertised volume.","revision":"A 15-year-old was arrested on 25 April. On 30 April the Paris prosecutor said the minor was suspected of having contributed to the data leak. A government information page that mistakenly referred to detection on 15 March is not used here: primary ANTS and Interior Ministry material consistently says 15 April.","quotes":[{"text":"11.7 million accounts may be concerned","original":"11,7 millions de comptes seraient concernés","originalLang":"fr","attribution":"France Titres / Interior Ministry, 21 April 2026","sourceId":"ants"},{"text":"internal technical investigations","original":"investigations techniques internes","originalLang":"fr","attribution":"France Titres, 21 April 2026","sourceId":"ants"}]}},{"id":"edustudents","date":"2026-04-14","year":2026,"org":"Education Ministry / ÉduConnect","domain":"education.gouv.fr","kind":"government","sector":"Education","sectorLabel":"Education","severity":"critical","status":"confirmed","affected":null,"affectedLabel":"Official pupil count unpublished","data":"Name, ÉduConnect identifier, school and class, email if supplied, and activation code for accounts not yet activated.","method":"Impersonated staff account plus a vulnerability exploited shortly before it was fixed.","risk":"School-themed phishing aimed at pupils and parents.","confidence":"Official disclosure; exact pupil count unpublished","sourceName":"French Education Ministry","sourceId":"eduStudents","sourceUrl":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-eleves-de-l-education-nationale-504443","sourceIds":["eduStudents","eduStudentsLemonde","eduStudentsAa","eduStudents01net"],"lastResearched":"2026-08-16","url":"/incident/edustudents","detail":{"lead":"The Education Ministry disclosed on 14 April 2026 that pupil data had been exfiltrated from a service adjacent to ÉduConnect. An authorised staff account was impersonated at the end of 2025, and a security flaw identified in December 2025 was exploited shortly before it was fixed.\n\nThe ministry confirmed exfiltration but did not publish a final pupil count. Criminal claims of 3.5 million pupils and 7.2 million report cards remain claims, not the ministry’s verified scope.","timeline":[{"date":"2025-12-01","label":"An authorised staff account is impersonated at the end of 2025, giving fraudulent access to the pupil-account management service (exact day not published)."},{"date":"2025-12-15","label":"A vulnerability in the service is identified in December and, the ministry says, exploited shortly before it was fixed (exact day not published)."},{"date":"2026-04-12","label":"A criminal group publicly advertises data it claims came from the education environment, including a multi-million-pupil figure."},{"date":"2026-04-14","label":"Education Ministry publicly confirms exfiltration; the exact pupil count is still under evaluation."},{"date":"2026-04-18","label":"Le Monde reports that the ministry still does not know the exact number of pupils affected."},{"date":"2026-06-09","label":"French investigators arrest seven people reported as alleged members of DumpSec, in a broader investigation into more than 1,500 targeted entities. This is attribution context; it does not validate the advertised pupil count."},{"date":"2026-06-12","label":"Security reporting connects the arrests with a wider DumpSec campaign and repeats the group’s ÉduConnect claims. Those numbers still remain outside the ministry’s confirmed count."}],"how":"Unlike COMPAS, this incident combines compromised identity with a software weakness. The ministry says an authorised staff account was impersonated and that a vulnerability in the account-management service was exploited shortly before it was fixed. The public statement does not name the vulnerability, provide a CVE, or explain the precise request sequence.","taken":"Officially confirmed fields are pupil first and last name, ÉduConnect identifier, school and class, email if provided, and activation code only for accounts not yet activated. The ministry confirmed data exfiltration. It did not publish a final pupil count by the research cutoff.","notTaken":"The ministry says accounts already activated by pupils and their guardians were not compromised and could continue to be used safely. It reset codes for unactivated accounts and blocked undistributed or unactivated accounts. The official field list does not include health data or social-security numbers.","impact":"Because the dataset concerns minors and schools, the main risk is highly credible school-themed phishing aimed at pupils and parents. School, class, identity and activation context can be used to impersonate a school administrator, parent portal or account-support process.","response":"The ministry suspended access to the affected service, activated a crisis cell, reset activation codes, blocked unactivated accounts, began strengthening access with MFA, notified ANSSI and CNIL, and filed a complaint. Families were warned to be alert to school-themed fraud.","methodDisclosure":"partial","attackerClaim":"DumpSec, or accounts attributed to the group, advertised about 3.5 million pupils and 7.2 million report cards. Those figures remain criminal claims. They are not a substitute for a ministry-verified pupil count.","revision":"In June 2026, French investigators arrested seven people reported as alleged DumpSec members in a broader investigation. That improves attribution context at campaign level. It does not validate the advertised pupil or report-card counts, and the official student count remains unpublished.","quotes":[{"text":"the exact number is being evaluated","original":"le nombre exact est en cours d’évaluation","originalLang":"fr","attribution":"French Education Ministry, 14 April 2026","sourceId":"eduStudents"},{"text":"impersonation of an authorised staff member’s account","original":"usurpation d’identité du compte d’un personnel habilité","originalLang":"fr","attribution":"French Education Ministry, 14 April 2026","sourceId":"eduStudents"}]}},{"id":"ficoba","date":"2026-01-31","year":2026,"org":"DGFiP / FICOBA","domain":"economie.gouv.fr","kind":"government","sector":"Finance / tax","sectorLabel":"Finance / tax","severity":"critical","status":"confirmed","affected":1200000,"affectedLabel":"About 1.2 million bank accounts","data":"Bank-account identifiers (RIB/IBAN), account-holder identity and postal address. The tax identifier was not consulted. No balances.","method":"Stolen credentials of a civil servant outside DGFiP, authorised for inter-ministry queries — not a FICOBA software flaw.","risk":"Targeted bank and tax phishing, identity fraud and fake-adviser scams.","confidence":"Official government disclosure and later parliamentary answers","sourceName":"French Finance Ministry","sourceId":"ficoba","sourceUrl":"https://presse.economie.gouv.fr/acces-illegitimes-au-fichier-national-des-comptes-bancaires-ficoba/","sourceIds":["ficoba","ficobaFaqPage","ficobaImpots","ficobaQ13230","ficobaQ13370"],"lastResearched":"2026-08-16","url":"/incident/ficoba","detail":{"lead":"From late January through 13 February 2026, an attacker used credentials belonging to a civil servant outside DGFiP who was authorised to query FICOBA for inter-ministry information exchange. About 1.2 million bank-account records — less than 1 percent of the register — were consulted or extracted.\n\nThe 1.2 million figure refers to bank accounts, not unique people. One person can hold more than one account, and one account can have several holders.","timeline":[{"date":"2026-01-28","label":"Illegitimate FICOBA consultations begin using the credentials of an authorised civil servant outside DGFiP."},{"date":"2026-02-13","label":"Last day of the illegitimate access window stated in later parliamentary answers."},{"date":"2026-02-16","label":"DGFiP makes its first CNIL notification, according to a later parliamentary response."},{"date":"2026-02-18","label":"Finance Ministry publicly discloses the incident and the approximately 1.2 million-account scope."},{"date":"2026-02-23","label":"DGFiP supplements its CNIL notification."},{"date":"2026-02-24","label":"Banks begin receiving securely transmitted information about their accounts in the consulted set."},{"date":"2026-04-28","label":"Parliamentary answer: the compromised account belonged to another administration, not a FICOBA software exploit."}],"how":"The attack used valid credentials attached to an authorised inter-ministry user outside DGFiP. The government has not published how those credentials were stolen. A parliamentary response states that the incident resulted from use of an account in a third administration and was not the result of a software vulnerability in FICOBA itself.","taken":"Bank-account identifiers such as RIB and IBAN, account-holder identity and postal address. The Finance Ministry said the tax identifier was not consulted during the illegitimate access.","notTaken":"FICOBA does not contain account balances or transaction history. The incident did not compromise bank passwords, impots.gouv.fr passwords or access to taxpayers’ secured tax spaces. An IBAN is sensitive for fraud, but it is not a credential that grants online-banking control.","impact":"The most credible downstream harms are targeted bank and tax phishing, identity fraud and attempts to create unauthorised direct debits. The combination of a real identity, address and IBAN is especially useful for a fake-bank adviser or administrative impersonation scam.","response":"DGFiP restricted external access, worked with ANSSI and ministry security officials, notified the CNIL, filed a complaint, contacted affected users, and provided banks with account-level information so they could strengthen monitoring and customer warnings. Later parliamentary responses say external access remained cut while security work continued.","methodDisclosure":"disclosed","revision":"Later parliamentary material confirms the first public account and adds the security-boundary finding: the compromised credentials belonged to a civil servant outside DGFiP, and the incident was not a FICOBA software exploit.","quotes":[{"text":"impersonated or used a civil servant’s credentials","original":"usurpé les identifiants d’un fonctionnaire","originalLang":"fr","attribution":"French Finance Ministry, 18 February 2026","sourceId":"ficoba"},{"text":"1.2 million accounts","original":"1,2 millions de comptes","originalLang":"fr","attribution":"French Finance Ministry, 18 February 2026","sourceId":"ficoba"}]}},{"id":"interior","date":"2025-12-11","year":2025,"org":"French Interior Ministry","domain":"interieur.gouv.fr","kind":"government","sector":"Law enforcement","sectorLabel":"Law enforcement","severity":"critical","status":"disputed","affected":null,"affectedLabel":"72 TAJ files and tens of thousands of TAJ index rows; 23 FPR files and ~3,000 FPR index elements; 1 Interpol file — not a person count","data":"72 full TAJ files plus tens of thousands of TAJ index rows; 23 FPR files plus ~3,000 FPR index elements; 1 Interpol file after 10 viewed. Not a person count.","method":"Compromised police mailboxes, then application passwords found in email, then a police portal. MFA stopped apps that already had it.","risk":"Exceptionally sensitive law-enforcement information, potential danger to individuals, investigations and operational security.","confidence":"Senate reconstruction of a confirmed breach; 16.4 million remains an attacker claim.","sourceName":"Sénat","sourceId":"interiorSenate","sourceUrl":"https://www.senat.fr/compte-rendu-commissions/20260112/lois.html","sourceIds":["interiorSenate","interiorSenateNews","interiorAssemblee","interiorPublicSenat","interior","interiorFrance24"],"lastResearched":"2026-08-16","url":"/incident/interior","detail":{"lead":"A criminal actor claimed access to data on more than 16 million people. The interior minister later rejected the idea that millions of complete records had been extracted. A Senate hearing on 13 January 2026 reconstructed a narrower, still serious scope: 72 full TAJ files plus tens of thousands of TAJ index rows, 23 FPR files plus about 3,000 FPR index elements, and 1 Interpol file exfiltrated after 10 were viewed. Those quantities are operational record counts, not a unique-person total.\n\nThe path ran from compromised professional mailboxes, through application passwords that agents had exchanged in email, to a Police nationale portal. Applications that already had MFA were attempted but not successfully penetrated.","timeline":[{"date":"2025-11-25","label":"DGPN notices that passwords to several police mailboxes have been changed."},{"date":"2025-11-28","label":"Services reset mailbox passwords themselves."},{"date":"2025-12-08","label":"The ministry knows that an unauthorised person has accessed a Police nationale portal and several applications. A criminal investigation is opened."},{"date":"2025-12-17","label":"Minister Laurent Nuñez publicly confirms access to TAJ and FPR and extraction of dozens of confidential files. A 22-year-old suspect is arrested."},{"date":"2026-01-13","label":"Nuñez gives the Senate the 72 TAJ, 23 FPR and Interpol figures, and describes MFA remediation."}],"how":"Compromised professional mailboxes gave the attacker access to messages in which some agents had exchanged passwords for internal applications. Those credentials opened a police portal shared across services — exposing roughly 150 applications, of which the attacker consulted seven — and enabled access to applications that were not protected by stronger factors. Nuñez told senators that applications already protected by MFA were attempted but not successfully penetrated. The initial failure was a chain: mailbox compromise, poor handling of application passwords in email, reuse of credentials to internal applications, then selective querying and extraction from sensitive police systems.","taken":"TAJ contains around 19 million files, but the attacker did not export all of them. The minister said 72 complete TAJ files were exfiltrated, together with tens of thousands of summary or index lines containing identity information but not the reason for a person’s TAJ listing. For FPR, 23 complete files and around 3,000 summary elements were extracted. Ten Interpol files were viewed and one was exfiltrated. These quantities are operational record counts, not a clean number of unique natural persons.","notTaken":"The minister said there was no extraction of millions of complete police records and no ransom demand. No destruction or modification of the police files was reported. An HR application available through the portal was not visited, according to the later hearing.","impact":"The sensitivity of even a small number of full police records is extreme. They can contain investigative, law-enforcement or personal information whose disclosure may affect witnesses, suspects, officers or active operations. Index rows can also be damaging because identity data from a police context can enable targeting or intimidation. The incident also showed that a hardened central database can still be exposed through weaker identity practices on surrounding systems.","response":"The ministry opened a criminal investigation, arrested a suspect on 17 December, reset administrative messaging passwords, removed roughly a thousand accounts belonging to departed personnel, worked with ANSSI on retrospective hunting and log review, and expanded MFA. Nuñez said MFA would be generalised across ministry applications, and the ministry reviewed access profiles and messaging practices.","methodDisclosure":"partial","attackerClaim":"A group using the name Indra claimed access to data on more than 16 million people and associated the figure with police files. That number closely resembled the size of TAJ rather than the amount later shown to have been extracted. The 16.4 million claim remains disputed attacker marketing, not a confirmed person count.","revision":"The first public account of “dozens of files” was reasonable immediately after the December disclosure. The January Senate hearing supplies the precise categories and counts disclosed by the minister, while a unique-person total remains unknown and the 16.4 million claim stays outside the numeric affected field.","quotes":[{"text":"What happened is very serious","original":"Ce qui s’est passé est très grave","originalLang":"fr","attribution":"Laurent Nuñez","sourceId":"interiorAssemblee"},{"text":"digital hygiene","original":"hygiène numérique","originalLang":"fr","attribution":"Laurent Nuñez, Senate hearing","sourceId":"interiorSenate"}]}}]}