{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"patterns":[{"id":"stolen-credentials","title":"Stolen credentials","description":"Compromised staff or third-party accounts can turn a normal login into a privileged intrusion. FICOBA, Education and DGFiP incidents all highlight identity and access risk.","priority":"Phishing-resistant MFA + tighter privileges"},{"id":"supplier-exposure","title":"Supplier exposure","description":"Air France/KLM, Eurofiber, CEVA and Sante publique France show how a supplier can become a route into many organisations or customers at once.","priority":"Vendor security + data minimisation"},{"id":"legacy-edge-systems","title":"Legacy and edge systems","description":"Old services, exposed gateways and vulnerable internet-facing software create high-value entry points. ANSSI specifically warns about vulnerable edge equipment.","priority":"Asset inventory + rapid patching"},{"id":"post-breach-phishing","title":"Phishing after the breach","description":"Names, phone numbers, addresses, tax details and order histories make scams much more believable. The breach is often only the first stage of harm to the public.","priority":"Verified channels + public warnings"},{"id":"excessive-data-reachability","title":"Too much reachable data","description":"When a compromised account can query large central databases, the blast radius becomes enormous. Sensitive datasets need segmentation and query-level controls.","priority":"Least privilege + segmentation + monitoring"},{"id":"detection-gaps","title":"Detection gaps","description":"Some breaches were discovered only after attacker claims or after access had already occurred. Logging alone is not enough if unusual extraction is not detected.","priority":"Behaviour analytics + exfiltration alerts"}]}