Skip to content
France Cyberwatch
enfr

Numbers

What the numbers show

These charts are built from this curated list, not from every breach in France. 8 incidents here have no published count, so they are left out of the totals rather than counted as zero. Select a bar to open the matching incidents.

8 concern government systems, 6 concern companies. 6 have a published count. 8 do not. Disputed scope: 1. Attacker-claimed figures stay in the label and are never summed.

Published account and record counts

Only incidents with a released figure

  • Critical
  • High

8 incidents have no published figure and are not plotted here.

Select a bar to open the matching incidents

Government and companies by year

Select a bar to open the matching incidents

Incidents by sector

Select a bar to open the matching incidents

Severity of the incidents tracked

  • Critical8 · 57%
  • High6 · 43%

Select a bar to open the matching incidents

National context

Where ANSSI saw incidents in 2025

France-wide figures, not this list — all ANSSI 2025 incidents

  • Education & research34%
  • Ministries & local government24%
  • Health10%
  • Telecom9%
  • Other23%
ANSSI - Panorama de la cybermenace 2025 (opens in a new tab)

France-wide figures, not this list

ANSSI and the CNIL publish country-wide figures. They cover far more than this curated list, so they sit in their own block.

ANSSI security events handled

3,586

Reports and incidents, 2025

CNIL data breach notifications

6,167

Around half involved hacking, 2025

Largest official estimate

11.7m

France Titres / ANTS

accounts, single incident

Confirmed leak rate

42%

of ANSSI’s possible leak events, 2025

For researchers

The repeating weaknesses named in the dataset, every field in a sortable table, and the full source ledger. The table uses the same filters as the incident list.

Patterns

Repeating patterns

The same handful of weaknesses shows up across these incidents. Each card names the weakness, the control that addresses it first, and the records whose own wording mentions the organisation.

  • Stolen credentials

    Compromised staff or third-party accounts can turn a normal login into a privileged intrusion. FICOBA, Education and DGFiP incidents all highlight identity and access risk.

    Priority control

    Phishing-resistant MFA + tighter privileges

    Named in this dossier

  • Supplier exposure

    Air France/KLM, Eurofiber, CEVA and Sante publique France show how a supplier can become a route into many organisations or customers at once.

    Priority control

    Vendor security + data minimisation

    Named in this dossier

  • Legacy and edge systems

    Old services, exposed gateways and vulnerable internet-facing software create high-value entry points. ANSSI specifically warns about vulnerable edge equipment.

    Priority control

    Asset inventory + rapid patching

  • Phishing after the breach

    Names, phone numbers, addresses, tax details and order histories make scams much more believable. The breach is often only the first stage of harm to the public.

    Priority control

    Verified channels + public warnings

  • Too much reachable data

    When a compromised account can query large central databases, the blast radius becomes enormous. Sensitive datasets need segmentation and query-level controls.

    Priority control

    Least privilege + segmentation + monitoring

  • Detection gaps

    Some breaches were discovered only after attacker claims or after access had already occurred. Logging alone is not enough if unusual extraction is not detected.

    Priority control

    Behaviour analytics + exfiltration alerts

Data

The full dataset

Every field from the incident records. Sort, filter, and export the rows you see.

14 matching incidents

14 rows shown

  • 14 Aug 2026

    DGFiP tax systems

    Government · Finance / tax

    Critical Confirmed

    678,000

    Tax data including reference income, household quotient and withholding rate; business name/SIREN. Cadastral data also consulted. User tax-space passwords not compromised.

    French Finance Ministry (opens in a new tab)

  • 13 Aug 2026

    Santé publique France contractor

    Government · Public health

    High Confirmed

    80,000

    Email, postal address and telephone. No medical data, diagnoses or social-security numbers.

    Le Parisien / AFP (opens in a new tab)

  • 29 Jul 2026

    CEVA Logistics

    Company · Logistics / supply chain

    High Confirmed

    Unknown person count; eight European warehouses

    Delivery data for downstream clients: names, addresses, phones, emails and order details.

    TechCrunch (opens in a new tab)

  • 25 Jul 2026

    Education Ministry staff system

    Government · Education

    Critical Confirmed

    A “significant number” of agents since 2001; exact count unpublished

    Identity and professional data; for some, address, phone and social-security number. No banking, passwords or pupil data.

    French Education Ministry (opens in a new tab)

  • 15 Apr 2026

    France Titres / ANTS

    Government · Identity / public services

    Critical Confirmed

    11,700,000

    Login identifier, title, names, email, date of birth and unique account ID; sometimes postal address, place of birth and phone.

    France Titres (ANTS) (opens in a new tab)

  • 14 Apr 2026

    Education Ministry / ÉduConnect

    Government · Education

    Critical Confirmed

    Official pupil count unpublished

    Name, ÉduConnect identifier, school and class, email if supplied, and activation code for accounts not yet activated.

    French Education Ministry (opens in a new tab)

  • 15 Mar 2026

    Education Ministry / COMPAS

    Government · Education

    High Confirmed

    243,000

    Identity, addresses, phone numbers and absence periods without the medical reason; tutor names and professional numbers.

    French Education Ministry (opens in a new tab)

  • 31 Jan 2026

    DGFiP / FICOBA

    Government · Finance / tax

    Critical Confirmed

    1,200,000

    Bank-account identifiers (RIB/IBAN), account-holder identity and postal address. The tax identifier was not consulted. No balances.

    French Finance Ministry (opens in a new tab)

  • 11 Dec 2025

    French Interior Ministry

    Government · Law enforcement

    Critical Disputed

    72 TAJ files and tens of thousands of TAJ index rows; 23 FPR files and ~3,000 FPR index elements; 1 Interpol file — not a person count

    72 full TAJ files plus tens of thousands of TAJ index rows; 23 FPR files plus ~3,000 FPR index elements; 1 Interpol file after 10 viewed. Not a person count.

    Sénat (opens in a new tab)

  • 13 Nov 2025

    Eurofiber France

    Company · Telecom / cloud supplier

    High Confirmed

    Customer scope not expressed as a verified person count

    Identification data, hashed passwords, ticket content and some attachments. Banking or critical data and network/cloud integrity were not compromised, Eurofiber said.

    Eurofiber France (opens in a new tab)

  • 10 Nov 2025

    Weda

    Company · Healthcare

    Critical Confirmed

    23,000 health professionals operationally locked out; patient count unknown

    Cross-tenant patient-data risk via API. Patient count unknown; 23,000 is operational lockout of health professionals.

    WEDA (opens in a new tab)

  • 06 Aug 2025

    Air France / KLM

    Company · Aviation

    High Confirmed

    Number not publicly disclosed

    Names, contact details, Flying Blue number and status, and subjects of customer-service requests. Passwords, travel data, passport and card numbers were reported unaffected.

    KLM (opens in a new tab)

  • 04 Aug 2025

    Bouygues Telecom

    Company · Telecommunications

    Critical Confirmed

    6,400,000

    Identity, contact, contract data and BIC/IBAN on 6.4 million customer accounts — not a unique-person count. Passwords and cards not exposed.

    Bouygues Telecom (opens in a new tab)

  • 25 Jul 2025

    Orange

    Company · Telecommunications

    High Confirmed

    Limited business-related files later acknowledged stolen; no customer-person count

    Later acknowledged: limited old or low-sensitivity business-related files. No confirmed consumer-database theft.

    Orange (opens in a new tab)

Source ledger

Every source this dossier cites, including follow-up reporting. Primary disclosures, official records and press are marked. Each entry lists the records that point to it.