{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"recommendations":{"organizations":[{"id":"phishing-resistant-mfa","title":"Use phishing-resistant MFA","description":"Prefer passkeys or hardware-backed authentication for administrators, remote access and sensitive databases. Avoid relying on SMS for privileged access.","explainerSlug":null},{"id":"least-privilege","title":"Make least privilege real","description":"Separate everyday accounts from privileged accounts, review access continuously, and require stronger controls for bulk queries or exports.","explainerSlug":null},{"id":"segment-sensitive-systems","title":"Segment sensitive systems","description":"Compromise of email or a training system should not become a route to police, tax, identity or financial datasets.","explainerSlug":null},{"id":"detect-extraction","title":"Detect extraction, not just login","description":"Alert on unusual record volumes, new locations, odd query patterns, bulk downloads and service-account behaviour.","explainerSlug":null},{"id":"supplier-perimeter","title":"Treat suppliers as part of your perimeter","description":"Contract for minimum controls, incident notification, logging, access boundaries and data deletion. Verify, do not just collect questionnaires.","explainerSlug":null},{"id":"reduce-retained-data","title":"Reduce retained data","description":"If a supplier does not need historical data, delete it. Less retained data means less to steal.","explainerSlug":null}],"public":[{"id":"assume-scam-use","title":"Assume leaked details may be used in scams","description":"A caller knowing your address, IBAN, tax office or recent order is not proof they are legitimate. Hang up and start from a number or site you already trust.","explainerSlug":"why-leaks-matter"},{"id":"open-official-services","title":"Open official services yourself","description":"Do not use a link from an unexpected email or SMS about taxes, deliveries, identity documents or banking. Open the official app or type the site address yourself. Bookmark that address so you are not guessing under pressure.","explainerSlug":"phishing-that-knows-you"},{"id":"named-context-still-unofficial","title":"A named school, class or tax office is still not official","description":"Those details are exactly what leaks. Open ÉduConnect, impôts or ANTS yourself. Do not use a link from an unexpected SMS.","explainerSlug":"when-the-state-is-the-source"},{"id":"never-share-codes","title":"Never share a one-time code on an inbound call","description":"A caller who recites your address or IBAN still needs you to read a banking or tax code, or to approve a payment. Hang up. Open the official app yourself.","explainerSlug":"phishing-that-knows-you"},{"id":"no-remote-access","title":"Do not install remote-control software because someone asked","description":"A “technician”, bank or tax agent who needs you to install a tool so they can “secure your account” is running the fraud. End the call and use the official app.","explainerSlug":"iban-and-banking"},{"id":"unique-passwords-passkeys","title":"Use unique passwords and passkeys","description":"A password manager prevents one stolen password from unlocking several services. If this service held a password you reused, change it on every other account that shared it. Enable MFA wherever available.","explainerSlug":"passwords-after-a-leak"},{"id":"watch-financial-activity","title":"Watch financial activity","description":"An exposed IBAN does not normally let someone directly take over an account, but it can support convincing fraud. Review transactions and bank alerts. Turn on alerts for new mandates and unusual transfers.","explainerSlug":"iban-and-banking"},{"id":"sepa-to-bank","title":"Take unexpected SEPA mandates to your bank","description":"An exposed IBAN can support a convincing direct-debit story. Do not confirm a mandate with the caller. Dispute it through your bank.","explainerSlug":"iban-and-banking"},{"id":"preserve-evidence","title":"Preserve evidence","description":"Keep suspicious emails, SMS, URLs and screenshots if you believe stolen data is being used against you. Report through official channels you open yourself, starting at Cybermalveillance.gouv.fr.","explainerSlug":"why-leaks-matter"},{"id":"expect-delayed-attacks","title":"Expect delayed attacks","description":"Stolen data can circulate for months or years. Increased caution should not end a week after the breach notice. Treat a message that reuses the organisation’s name months later the same way you would treat one that arrives tomorrow.","explainerSlug":"health-school-long-tail"}]}}