Incidents

DGFiP tax systems

The DGFiP confirmed on 14 August 2026 that two illegitimate-access incidents in June and July had relied on stolen or impersonated credentials belonging to a DGFiP agent and an authorised third party. When the intrusions were detected, access to the implicated accounts was cut. At that time, however, the access-control review did not identify that data had already been stolen. The decisive trigger came on 12 and 13 August, when a malicious actor publicly claimed the intrusions. DGFiP then matched the claims against its logs and established that data concerning a total of 678,000 individuals and businesses had been consulted and extracted before access was terminated.

Stolen credentials of a DGFiP agent and an authorised third party.

Santé publique France contractor

Santé publique France confirmed on 13 August 2026 that a contractor-hosted platform used to order public-health prevention materials had been attacked. The affected service, moncoupon.santepubliquefrance.fr, operates separately from the agency’s other sites and systems. About 80,000 contact records were affected. The database was used to ship ordered materials and contained email addresses, postal addresses and telephone numbers. This is a public-health-sector breach, but not a breach of medical records.

Attack on a contractor-hosted ordering platform. Initial access not disclosed.

CEVA Logistics

A cyber intrusion hit part of CEVA Logistics’ European contract-logistics operation beginning around 29 July 2026. CEVA told affected customers that the incident was identified on 1 August and later confirmed to press that the operational impact was limited to eight European warehouses. The breach became visible through CEVA’s customers. Downstream retailers and Valve, which uses CEVA to ship Steam hardware in Europe, warned that shipping information held by CEVA had been accessed or copied. No public person count has been established.

Initial access not publicly confirmed.

Education Ministry staff system

The Education Ministry disclosed on 31 July 2026 that a professional account had been impersonated during the night of 25 July, giving fraudulent access to an information system dedicated to staff training. The ministry security operations centre was alerted on 26 July and external access was suspended. The system contained identity and professional information about agents who had worked in academies since 2001. The ministry described the potential population only as a significant number of agents. No official quantified update was found before the 16 August research cutoff.

Impersonation of a professional account.

France Titres / ANTS

France Titres, also known as ANTS, detected a security incident on 15 April 2026 involving the ants.gouv.fr portal. The 21 April official update said about 11.7 million individual and professional accounts could be concerned. That figure is phrased as accounts that may be concerned. It should not automatically be read as 11.7 million complete records definitely downloaded. Criminal claims of roughly 18 to 19 million records are not the official count.

Official cause still under investigation.

Education Ministry / ÉduConnect

The Education Ministry disclosed on 14 April 2026 that pupil data had been exfiltrated from a service adjacent to ÉduConnect. An authorised staff account was impersonated at the end of 2025, and a security flaw identified in December 2025 was exploited shortly before it was fixed. The ministry confirmed exfiltration but did not publish a final pupil count. Criminal claims of 3.5 million pupils and 7.2 million report cards remain claims, not the ministry’s verified scope.

Impersonated staff account plus a vulnerability exploited shortly before it was fixed.

Education Ministry / COMPAS

An attacker used an impersonated external account to reach COMPAS, the Education Ministry information system used to manage trainee teachers. The fraudulent access occurred on 15 March 2026. The ministry’s security operations centre was alerted on 19 March after unauthorised dissemination of COMPAS data was identified. About 243,000 agents, including trainees and permanent staff recorded in the system, had data exfiltrated. That figure is an official approximate person count.

Impersonation of an external account.

DGFiP / FICOBA

From late January through 13 February 2026, an attacker used credentials belonging to a civil servant outside DGFiP who was authorised to query FICOBA for inter-ministry information exchange. About 1.2 million bank-account records — less than 1 percent of the register — were consulted or extracted. The 1.2 million figure refers to bank accounts, not unique people. One person can hold more than one account, and one account can have several holders.

Stolen credentials of a civil servant outside DGFiP, authorised for inter-ministry queries — not a FICOBA software flaw.

French Interior Ministry

A criminal actor claimed access to data on more than 16 million people. The interior minister later rejected the idea that millions of complete records had been extracted. A Senate hearing on 13 January 2026 reconstructed a narrower, still serious scope: 72 full TAJ files plus tens of thousands of TAJ index rows, 23 FPR files plus about 3,000 FPR index elements, and 1 Interpol file exfiltrated after 10 were viewed. Those quantities are operational record counts, not a unique-person total. The path ran from compromised professional mailboxes, through application passwords that agents had exchanged in email, to a Police nationale portal. Applications that already had MFA were attempted but not successfully penetrated.

Compromised police mailboxes, then application passwords found in email, then a police portal. MFA stopped apps that already had it.

Eurofiber France

Eurofiber France published a detailed postmortem of an incident affecting its customer ticketing platform for Eurofiber France and regional brands, plus the ATE / Eurofiber Cloud Infra France customer portal. The company traced the first activity to 6 November 2025, when the attacker used blind SQL injection against the user database. From 10 November, exfiltration intensified through REST API calls targeting tickets and documents. Monitoring detected anomalies on 13 November at 14:49.

Blind SQL injection against the user database, then REST-API exfiltration of tickets and documents.

Weda

WEDA’s own material prepared to help customers complete CNIL breach notifications states that monitoring detected an abnormal activity spike at 17:00 on 10 November 2025 on a customer account making many API calls. Once a user was authenticated to a WEDA customer account, the API could return patient data even when those patients were not attached to that healthcare professional’s account. Around 23,000 health professionals lost normal access when WEDA shut the application at 23:00. That figure is operational lockout, not a patient count. WEDA classified the event as a confidentiality loss and listed patients as the affected category, while stating that the approximate number of records and people was still under investigation.

Authenticated customer accounts plus a cross-tenant API authorisation weakness.

Air France / KLM

Air France and KLM disclosed in early August 2025 that an external platform used for customer service had been accessed without authorisation. They stressed that the compromised environment was a third-party customer-service platform, not their core airline networks. The number of customers was never publicly disclosed.

Unauthorised access to a third-party customer-service platform; the vendor is unnamed.

Bouygues Telecom

Bouygues Telecom detected a cyberattack on 4 August 2025 and disclosed it two days later. The intrusion gave unauthorised access to personal data linked to 6.4 million customer accounts. That figure is a count of accounts, not necessarily 6.4 million unique people. Exposed fields included contact and civil-status information, contract information and banking identifiers such as BIC and IBAN. Bouygues said account passwords and payment-card numbers were not exposed.

Unauthorised access; the initial access route has not been published.

Orange

Orange detected a cyberattack on one of its information systems on 25 July 2025. Isolating potentially affected services interrupted some business-management platforms and several consumer-facing services, mainly in France. On 28 July the company said it had found no evidence that Orange or customer data had been exfiltrated. That first conclusion did not hold. In August, material attributed to the intrusion appeared on a criminal leak site. Orange then acknowledged limited access and that old or low-sensitivity information concerning business customers had been taken. No verified customer-person count has been published. A separate Orange Belgium event affecting about 850,000 accounts is not this incident.

Cyberattack on an information system; the initial access route has not been published.