11 December 2025
French Interior Ministry
Government Law enforcement
The scope of this incident is contested. Attacker claims are shown as claims and are never counted in the charts or totals on this site.
A criminal actor claimed access to data on more than 16 million people. The interior minister later rejected the idea that millions of complete records had been extracted. A Senate hearing on 13 January 2026 reconstructed a narrower, still serious scope: 72 full TAJ files plus tens of thousands of TAJ index rows, 23 FPR files plus about 3,000 FPR index elements, and 1 Interpol file exfiltrated after 10 were viewed. Those quantities are operational record counts, not a unique-person total.
The path ran from compromised professional mailboxes, through application passwords that agents had exchanged in email, to a Police nationale portal. Applications that already had MFA were attempted but not successfully penetrated.
Dated facts in the public record
DGPN notices that passwords to several police mailboxes have been changed.
Services reset mailbox passwords themselves.
The ministry knows that an unauthorised person has accessed a Police nationale portal and several applications. A criminal investigation is opened.
Minister Laurent Nuñez publicly confirms access to TAJ and FPR and extraction of dozens of confidential files. A 22-year-old suspect is arrested.
Nuñez gives the Senate the 72 TAJ, 23 FPR and Interpol figures, and describes MFA remediation.
How it happened
Compromised professional mailboxes gave the attacker access to messages in which some agents had exchanged passwords for internal applications. Those credentials opened a police portal shared across services — exposing roughly 150 applications, of which the attacker consulted seven — and enabled access to applications that were not protected by stronger factors. Nuñez told senators that applications already protected by MFA were attempted but not successfully penetrated. The initial failure was a chain: mailbox compromise, poor handling of application passwords in email, reuse of credentials to internal applications, then selective querying and extraction from sensitive police systems.
What was exposed
TAJ contains around 19 million files, but the attacker did not export all of them. The minister said 72 complete TAJ files were exfiltrated, together with tens of thousands of summary or index lines containing identity information but not the reason for a person’s TAJ listing. For FPR, 23 complete files and around 3,000 summary elements were extracted. Ten Interpol files were viewed and one was exfiltrated. These quantities are operational record counts, not a clean number of unique natural persons.
What was not in scope
The minister said there was no extraction of millions of complete police records and no ransom demand. No destruction or modification of the police files was reported. An HR application available through the portal was not visited, according to the later hearing.
What it meant in practice
The sensitivity of even a small number of full police records is extreme. They can contain investigative, law-enforcement or personal information whose disclosure may affect witnesses, suspects, officers or active operations. Index rows can also be damaging because identity data from a police context can enable targeting or intimidation. The incident also showed that a hardened central database can still be exposed through weaker identity practices on surrounding systems.
Attacker claim (not a confirmed count)
A group using the name Indra claimed access to data on more than 16 million people and associated the figure with police files. That number closely resembled the size of TAJ rather than the amount later shown to have been extracted. The 16.4 million claim remains disputed attacker marketing, not a confirmed person count.
What was done next
The ministry opened a criminal investigation, arrested a suspect on 17 December, reset administrative messaging passwords, removed roughly a thousand accounts belonging to departed personnel, worked with ANSSI on retrospective hunting and log review, and expanded MFA. Nuñez said MFA would be generalised across ministry applications, and the ministry reviewed access profiles and messaging practices.
What later reporting changed
The first public account of “dozens of files” was reasonable immediately after the December disclosure. The January Senate hearing supplies the precise categories and counts disclosed by the minister, while a unique-person total remains unknown and the 16.4 million claim stays outside the numeric affected field.
In their words
What happened is very serious
Original Ce qui s’est passé est très grave
Laurent Nuñez
digital hygiene
Original hygiène numérique
Laurent Nuñez, Senate hearing
What does this mean?
- MFA (multi-factor authentication)
- A second proof of identity on top of the password — a code, an app or a security key. Phishing-resistant methods are keys and passkeys.
- Exfiltration
- Copying data out of a system to somewhere the attacker controls.
- Credentials
- A username and password pair, or the equivalent key an application uses to log in.
- TAJ
- France’s police file of judicial antecedents — records of people linked to criminal investigations.
- FPR
- The wanted-persons file used by French police and gendarmerie.