{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}}},"sources":[{"id":"anssi","name":"ANSSI - Panorama de la cybermenace 2025","url":"https://cyber.gouv.fr/actualites/panorama-de-la-cybermenace-2025/","publisher":"ANSSI","kind":"official","published":"2026-03-11","citedBy":[]},{"id":"cnil","name":"CNIL - Annual report 2025","url":"https://www.cnil.fr/en/annual-report-2025","publisher":"CNIL","kind":"official","published":"2026-05-19","citedBy":[]},{"id":"orange","name":"Orange - Security incident disclosure","url":"https://newsroom.orange.com/the-orange-group-announces-that-it-filed-a-complaint-on-monday-28-july-concerning-a-security-incident-on-one-of-its-information-systems/?lang=eng","publisher":"Orange","kind":"primary","published":"2025-07-28","citedBy":["orange"]},{"id":"orangeFollowup","name":"ZDNet — Orange later confirmed a limited data leak","url":"https://www.zdnet.fr/actualites/la-cyberattaque-dorange-se-solde-finalement-par-une-fuite-de-donnees-480732.htm","publisher":"ZDNet France","kind":"secondary","published":"2025-08-25","citedBy":["orange"]},{"id":"orange01net","name":"01net — Orange data published on a leak site","url":"https://www.01net.com/actualites/cyberattaque-contre-orange-donnees-piratees-diffusees-dark-web.html","publisher":"01net","kind":"secondary","published":"2025-08-26","citedBy":["orange"]},{"id":"airfranceKlm","name":"KLM — customer notice on a personal-data incident","url":"https://nieuws.klm.com/klm-informeert-klanten-over-incident-met-persoonsgegevens/","publisher":"KLM","kind":"primary","published":"2025-08-06","citedBy":["airfrance"]},{"id":"airfrance","name":"ITPro — Air France and KLM third-party breach","url":"https://www.itpro.com/security/data-breaches/air-france-and-klm-confirm-customer-data-stolen-in-third-party-breach","publisher":"ITPro","kind":"secondary","published":"2025-08-06","citedBy":["airfrance"]},{"id":"airfranceBleeping","name":"BleepingComputer — Air France and KLM third-party breach","url":"https://www.bleepingcomputer.com/news/security/air-france-and-klm-disclose-data-breaches-impacting-customers/","publisher":"BleepingComputer","kind":"secondary","published":"2025-08-07","citedBy":["airfrance"]},{"id":"airfranceSecurityweek","name":"SecurityWeek — Air France, KLM customer data accessed","url":"https://www.securityweek.com/air-france-klm-say-hackers-accessed-customer-data/","publisher":"SecurityWeek","kind":"secondary","published":"2025-08-07","citedBy":["airfrance"]},{"id":"bouygues","name":"Bouygues Telecom - Cyberattack disclosure","url":"https://www.corporate.bouyguestelecom.fr/archives-communique-presse/bouygues-telecom-annonce-avoir-ete-victime-dune-cyberattaque/","publisher":"Bouygues Telecom","kind":"primary","published":"2025-08-06","citedBy":["bouygues"]},{"id":"bouyguesFaq","name":"Bouygues Telecom — customer FAQ on the August 2025 attack","url":"https://mag.bouyguestelecom.fr/cybersecurite/cyberattaque-fuite-de-donnees-questions/","publisher":"Bouygues Telecom","kind":"primary","published":"2025-08-13","citedBy":["bouygues"]},{"id":"bouyguesCybermalveillance","name":"Cybermalveillance.gouv.fr — Bouygues Telecom breach advice","url":"https://www.cybermalveillance.gouv.fr/tous-nos-contenus/actualites/violation-de-donnees-personnelles-bouygues-telecom-202508","publisher":"Cybermalveillance.gouv.fr","kind":"official","published":"2026-02-04","citedBy":["bouygues"]},{"id":"bouyguesLemonde","name":"Le Monde — Bouygues Telecom breach and the telecom sector","url":"https://www.lemonde.fr/economie/article/2025/08/07/le-piratage-d-ampleur-de-bouygues-telecom-confirme-que-les-operateurs-telecoms-sont-dans-le-viseur-des-cybercriminels_6627266_3234.html","publisher":"Le Monde","kind":"secondary","published":"2025-08-07","citedBy":["bouygues"]},{"id":"bouyguesTechcrunch","name":"TechCrunch — Bouygues Telecom data breach","url":"https://techcrunch.com/2025/08/07/data-breach-at-french-telecom-giant-bouygues-affects-millions-of-customers/","publisher":"TechCrunch","kind":"secondary","published":"2025-08-07","citedBy":["bouygues"]},{"id":"wedaCnil","name":"WEDA — CNIL breach-notification guidance","url":"https://assistance.weda.fr/hubfs/2025-11_Notification%20violation%20CNIL%20WEDA.pdf","publisher":"WEDA","kind":"primary","published":"2025-11-12","citedBy":["weda"]},{"id":"wedaCnilDirect","name":"CNIL — question on the WEDA breach notification","url":"https://www.cnil.fr/en/cnil-direct/question/2652","publisher":"CNIL","kind":"official","published":"2025-11-11","citedBy":["weda"]},{"id":"wedaLemonde","name":"Le Monde — WEDA cyberattack, paralysis and data leak","url":"https://www.lemonde.fr/pixels/article/2025/11/18/une-cyberattaque-contre-weda-logiciel-utilise-par-des-milliers-de-medecins-provoque-paralysie-et-fuite-de-donnees_6653915_4408996.html","publisher":"Le Monde","kind":"secondary","published":"2025-11-18","citedBy":["weda"]},{"id":"weda","name":"01net — WEDA medical-software attack","url":"https://www.01net.com/actualites/cyberattaque-inquietante-france-donnees-medicales-auraient-piratees-23-000-professionnels-sante-paralyses.html","publisher":"01net","kind":"secondary","published":"2025-11-18","citedBy":["weda"]},{"id":"wedaCaducee","name":"Caducee.net — WEDA, 23,000 health professionals","url":"https://www.caducee.net/actualite-medicale/16693/cyberattaque-weda-23-000-soignants-concernes.html","publisher":"Caducee.net","kind":"secondary","published":"2025-11-19","citedBy":["weda"]},{"id":"wedaAvec","name":"AVEC Santé Nouvelle-Aquitaine — WEDA guidance for practices","url":"https://avecsantena.fr/cyberattaque-du-logiciel-weda-que-sest-il-passe-et-comment-reagir-pour-une-msp/","publisher":"AVEC Santé Nouvelle-Aquitaine","kind":"secondary","published":"2025-11-17","citedBy":["weda"]},{"id":"eurofiberInitial","name":"Eurofiber France — 13 November incident announcement","url":"https://www.eurofiber.com/fr-fr/actualites/incident-de-cybersecurite-chez-eurofiber-france","publisher":"Eurofiber France","kind":"primary","published":"2025-11-13","citedBy":["eurofiber"]},{"id":"eurofiber","name":"Eurofiber France - November 2025 incident review","url":"https://www.eurofiber.com/fr-fr/actualites/incident-de-cybersecurite-du-13-novembre-enseignements-et-actions-engagees","publisher":"Eurofiber France","kind":"primary","published":"2025-12-15","citedBy":["eurofiber"]},{"id":"eurofiberCloud","name":"Eurofiber Cloud Infra — November incident review","url":"https://eurofibercloudinfra.fr/2025/12/22/incident-de-cybersecurite-du-13-novembre-enseignements-et-actions-engagees/","publisher":"Eurofiber Cloud Infra","kind":"primary","published":"2025-12-22","citedBy":["eurofiber"]},{"id":"interiorSenate","name":"Sénat — Commission des lois, audition de Laurent Nuñez","url":"https://www.senat.fr/compte-rendu-commissions/20260112/lois.html","publisher":"Sénat","kind":"official","published":"2026-01-13","citedBy":["interior"]},{"id":"interiorSenateNews","name":"Sénat — Audition de Laurent Nuñez","url":"https://www.senat.fr/actualite/audition-de-laurent-nunez-6388.html","publisher":"Sénat","kind":"official","published":"2026-01-13","citedBy":["interior"]},{"id":"interiorAssemblee","name":"Assemblée nationale — séance du 17 décembre 2025","url":"https://questions.assemblee-nationale.fr/dyn/17/comptes-rendus/seance/session-ordinaire-de-2025-2026/premiere-seance-du-mercredi-17-decembre-2025","publisher":"Assemblée nationale","kind":"official","published":"2025-12-17","citedBy":["interior"]},{"id":"interiorPublicSenat","name":"Public Sénat — MFA after the Interior Ministry intrusion","url":"https://www.publicsenat.fr/actualites/politique/cyberattaque-contre-le-ministere-de-linterieur-laurent-nunez-va-generaliser-la-double-identification-pour-lacces-aux-applications","publisher":"Public Sénat","kind":"secondary","published":"2026-01-13","citedBy":["interior"]},{"id":"interior","name":"Le Monde — Interior Ministry databases pirated","url":"https://www.lemonde.fr/en/pixels/article/2025/12/17/hackers-pirate-french-interior-ministry-databases_6748599_13.html","publisher":"Le Monde","kind":"secondary","published":"2025-12-17","citedBy":["interior"]},{"id":"interiorFrance24","name":"France 24 — Interior Ministry, tens of files extracted","url":"https://www.france24.com/fr/info-en-continu/20251217-des-dizaines-de-fichiers-sensibles-du-ministere-de-l-interieur-voles-lors-dune-attaque-informatique","publisher":"France 24","kind":"secondary","published":"2025-12-17","citedBy":["interior"]},{"id":"ficoba","name":"French Finance Ministry - FICOBA illegal access","url":"https://presse.economie.gouv.fr/acces-illegitimes-au-fichier-national-des-comptes-bancaires-ficoba/","publisher":"Ministry of Finance","kind":"primary","published":"2026-02-18","citedBy":["ficoba"]},{"id":"ficobaFaqPage","name":"Ministry of Economy — FICOBA, what to know","url":"https://www.economie.gouv.fr/actualites/ficoba-tout-savoir-lacces-illegitime-au-fichier-national-des-comptes-bancaires","publisher":"Ministry of Economy and Finance","kind":"primary","published":"2026-03-03","citedBy":["ficoba"]},{"id":"ficobaImpots","name":"impots.gouv.fr — FICOBA illegitimate access","url":"https://www.impots.gouv.fr/actualite/acces-illegitimes-au-fichier-national-des-comptes-bancaires-ficoba","publisher":"DGFiP","kind":"primary","published":"2026-02-27","citedBy":["ficoba"]},{"id":"ficobaQ13230","name":"Assemblée nationale — question n°13230 on FICOBA","url":"https://questions.assemblee-nationale.fr/q17/17-13230QE.htm","publisher":"Assemblée nationale","kind":"official","published":"2026-04-28","citedBy":["ficoba"]},{"id":"ficobaQ13370","name":"Assemblée nationale — question n°13370 on FICOBA user support","url":"https://questions.assemblee-nationale.fr/q17/17-13370QE.htm","publisher":"Assemblée nationale","kind":"official","published":"2026-06-09","citedBy":["ficoba"]},{"id":"eduCompas","name":"French Education Ministry - COMPAS incident","url":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-personnels-de-l-education-nationale-470657","publisher":"Ministry of Education","kind":"primary","published":"2026-03-23","citedBy":["educompas"]},{"id":"eduCompasSenat","name":"Sénat — cyber protection of administrations, COMPAS response","url":"https://www.senat.fr/questions/base/2026/qSEQ26030760G.html","publisher":"Sénat","kind":"official","published":"2026-03-26","citedBy":["educompas"]},{"id":"eduCompasRtl","name":"RTL — 243,000 education staff after COMPAS","url":"https://www.rtl.fr/actu/sciences-tech/ils-peuvent-nous-localiser-l-inquietude-des-enseignants-apres-le-piratage-des-coordonnees-de-243-000-agents-de-l-education-nationale-7900616158","publisher":"RTL","kind":"secondary","published":"2026-03-24","citedBy":["educompas"]},{"id":"eduCompasAef","name":"AEF Info — COMPAS, 243,000 education staff","url":"https://www.aefinfo.fr/depeche/747986","publisher":"AEF Info","kind":"secondary","published":"2026-03-23","citedBy":["educompas"]},{"id":"eduStudents","name":"French Education Ministry - EduConnect incident","url":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-eleves-de-l-education-nationale-504443","publisher":"Ministry of Education","kind":"primary","published":"2026-04-14","citedBy":["edustudents"]},{"id":"eduStudentsLemonde","name":"Le Monde — education sector as a cyber target","url":"https://www.lemonde.fr/pixels/article/2026/04/18/fuites-de-donnees-l-education-nationale-une-cible-vulnerable-face-aux-cyberattaques_6681062_4408996.html","publisher":"Le Monde","kind":"secondary","published":"2026-04-18","citedBy":["edustudents"]},{"id":"eduStudentsAa","name":"Anadolu Agency — pupil data compromised","url":"https://www.aa.com.tr/fr/france/cyberattaque-contre-l-%C3%A9ducation-nationale-des-donn%C3%A9es-d-%C3%A9l%C3%A8ves-compromises/3905581","publisher":"Anadolu Agency","kind":"secondary","published":"2026-04-14","citedBy":["edustudents"]},{"id":"eduStudents01net","name":"01net — seven arrests after a wider DumpSec investigation","url":"https://www.01net.com/actualites/fuite-donnees-france-arrete-7-jeunes-hackers-apres-plus-1500-cyberattaques.html","publisher":"01net","kind":"secondary","published":"2026-06-12","citedBy":["edustudents"]},{"id":"ants","name":"France Titres / ANTS - April 2026 incident update","url":"https://mairie.ants.gouv.fr/toute-l-actualite/incident-de-securite-relatif-au-portail-antsgouvfr-point-detape-du-21-avril-2026","publisher":"France Titres / ANTS","kind":"primary","published":"2026-04-21","citedBy":["ants"]},{"id":"antsInterior","name":"Interior Ministry — ANTS portal incident update","url":"https://www.interieur.gouv.fr/actualites/communiques-de-presse/point-detape-du-21-avril-2026-concernant-lincident-de-securite-relatif-au-portail-antsgouvfr","publisher":"Ministry of the Interior","kind":"primary","published":"2026-04-21","citedBy":["ants"]},{"id":"antsTf1Maintenance","name":"TF1 Info — ANTS portal closed for maintenance","url":"https://www.tf1info.fr/justice-faits-divers/piratage-massif-de-l-ants-agence-nationale-titres-securises-le-portail-ferme-des-ce-vendredi-24-avril-pour-maintenance-2438027.html","publisher":"TF1 Info","kind":"secondary","published":"2026-04-24","citedBy":["ants"]},{"id":"antsLemonde","name":"Le Monde — what is known about the ANTS leak","url":"https://www.lemonde.fr/pixels/article/2026/04/22/fuite-de-donnees-a-l-ants-site-qui-gere-les-demandes-de-pieces-d-identite-ce-que-l-on-sait_6682414_4408996.html","publisher":"Le Monde","kind":"secondary","published":"2026-04-22","citedBy":["ants"]},{"id":"antsLemondeArrest","name":"Le Monde — 15-year-old arrested over the ANTS leak","url":"https://www.lemonde.fr/pixels/article/2026/04/30/piratage-de-l-ants-un-mineur-de-15-ans-interpelle_6684591_4408996.html","publisher":"Le Monde","kind":"secondary","published":"2026-04-30","citedBy":["ants"]},{"id":"antsTf1Breach3d","name":"TF1 Info — prosecutor statement on the ANTS arrest","url":"https://www.tf1info.fr/justice-faits-divers/piratage-de-l-ants-ce-que-l-on-sait-de-breach3d-l-adolescent-de-15-ans-place-en-garde-a-vue-2439078.html","publisher":"TF1 Info","kind":"secondary","published":"2026-04-30","citedBy":["ants"]},{"id":"eduStaff","name":"French Education Ministry - Staff-data incident","url":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-personnels-de-l-education-nationale-505407","publisher":"Ministry of Education","kind":"primary","published":"2026-07-31","citedBy":["edustaff"]},{"id":"cevaTechcrunch","name":"TechCrunch — CEVA Logistics warehouse breach","url":"https://techcrunch.com/2026/08/10/a-data-breach-at-shipping-giant-ceva-logistics-is-rippling-across-banks-retailers-steam-gamers-and-beyond/","publisher":"TechCrunch","kind":"secondary","published":"2026-08-10","citedBy":["ceva"]},{"id":"cevaVerge","name":"The Verge — Steam hardware shipper breach","url":"https://www.theverge.com/games/977314/valve-steam-hardware-shipping-data-breach","publisher":"The Verge","kind":"secondary","published":"2026-08-10","citedBy":["ceva"]},{"id":"cevaPcgamer","name":"PC Gamer — Valve notice on the CEVA shipping breach","url":"https://www.pcgamer.com/gaming-industry/steam-user-data-may-have-been-compromised-by-a-cyberattack-targeting-valves-european-shipping-partner/","publisher":"PC Gamer","kind":"secondary","published":"2026-08-10","citedBy":["ceva"]},{"id":"cevaComputing","name":"Computing — CEVA Logistics hack across Europe","url":"https://www.computing.co.uk/news/2026/security/ceva-logistics-hack-affects-firms-across-europe","publisher":"Computing","kind":"secondary","published":"2026-08-12","citedBy":["ceva"]},{"id":"ceva","name":"TechRadar — CEVA Logistics knock-on effects","url":"https://www.techradar.com/pro/security/the-ceva-logistics-data-breach-is-having-major-knock-on-effects-across-europe-heres-what-we-know","publisher":"TechRadar","kind":"secondary","published":"2026-08-11","citedBy":["ceva"]},{"id":"santeParisien","name":"Le Parisien / AFP — Santé publique France contractor, 80,000 people","url":"https://www.leparisien.fr/faits-divers/cyberattaque-dun-prestataire-de-sante-publique-france-80-000-personnes-concernees-par-la-fuite-de-donnees-13-08-2026-FTP4SNTQI5DOVMQDCBBTQX5F4U.php","publisher":"Le Parisien","kind":"secondary","published":"2026-08-13","citedBy":["sante"]},{"id":"sante","name":"E-Santé — Santé publique France contractor breach","url":"https://www.e-sante.fr/cyberattaque-chez-sante-publique-france-les-donnees-de-contact-de-80-000-usagers-piratees/actualite/744070","publisher":"E-Santé","kind":"secondary","published":"2026-08-14","citedBy":["sante"]},{"id":"dgfip","name":"French Finance Ministry - DGFiP illegal access","url":"https://presse.economie.gouv.fr/acces-illegitime-au-systeme-dinformation-de-la-direction-generale-des-finances-publiques/","publisher":"Ministry of Finance","kind":"primary","published":"2026-08-14","citedBy":["dgfip"]},{"id":"dgfipLemonde","name":"Le Monde — French taxpayers’ data stolen","url":"https://www.lemonde.fr/en/pixels/article/2026/08/14/french-taxpayers-data-stolen-in-hack-of-finance-ministry_6756510_13.html","publisher":"Le Monde","kind":"secondary","published":"2026-08-14","citedBy":["dgfip"]},{"id":"dgfipBriefing","name":"Le Figaro — DGFiP briefing on the 678,000-account intrusion","url":"https://www.lefigaro.fr/conjoncture/piratage-de-l-administration-fiscale-la-dgfip-revele-les-contours-du-vol-de-donnees-de-678-000-comptes-20260814","publisher":"Le Figaro","kind":"secondary","published":"2026-08-14","citedBy":["dgfip"]},{"id":"dgfipEntrevue","name":"Entrevue — Paris prosecutor opens an inquiry","url":"https://entrevue.fr/societe/piratage-du-fisc-le-parquet-de-paris-ouvre-une-enquete-sur-678-000-victimes/","publisher":"Entrevue","kind":"secondary","published":"2026-08-16","citedBy":["dgfip"]}]}