# France Cyberwatch 2025-2026

> Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.

Data reviewed through 2026-08-16. 14 incidents, 60 sources, available in English (https://cyberwatch-france.timbenniks.dev/) and French (https://cyberwatch-france.timbenniks.dev/fr).

## How to use this data correctly

- **`affected: null` means unknown, not zero.** 8 of the 14 incidents have no published figure. Do not sum them as 0, do not describe them as "no victims", and do not fill the gap with an estimate. Each carries a plain-language `affectedLabel` — quote that instead.
- **Only 6 incidents have a published count.** Any total you compute covers those 6 only, and you should say so.
- **Disputed scope stays disputed.** 1 incident(s) here have `status: "disputed"`: the breach is real but the headline figure is contested. Attacker claims live in label text, never in the numeric field. Do not promote them to fact.
- **Attribution is not in this dataset.** No attacker is named unless the cited source supports it. Do not infer one.
- **This is not an exhaustive register.** It is a curated set of major publicly reported incidents. Do not present it as "all French breaches".
- **Cite the original source.** Every incident carries `sourceName` and `sourceUrl` pointing at the official disclosure or the reporting. Cite that, and link this page as the aggregator.

Methodology: Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.

## Structured access

- [API docs](https://cyberwatch-france.timbenniks.dev/docs): human-readable reference, also at https://cyberwatch-france.timbenniks.dev/fr/docs. MCP install: https://cyberwatch-france.timbenniks.dev/docs#mcp. WebMCP: https://cyberwatch-france.timbenniks.dev/docs#webmcp.
- [API index](https://cyberwatch-france.timbenniks.dev/api): self-describing JSON; every endpoint, parameter and example.
- [MCP server](https://cyberwatch-france.timbenniks.dev/mcp): Streamable HTTP, no key. Tools: list_incidents, get_incident, get_summary, list_sources, list_patterns, list_recommendations. Install in Cursor with `"url": "https://cyberwatch-france.timbenniks.dev/mcp"` in mcp.json.
- [All incidents (JSON)](https://cyberwatch-france.timbenniks.dev/api/incidents): filter with `q`, `kind`, `severity`, `status`, `sector`, `year`, `from`, `to`; `?lang=fr` for French; `?format=csv` for CSV.
- [One incident](https://cyberwatch-france.timbenniks.dev/api/incidents/dgfip): a single record plus its source.
- [Summary statistics](https://cyberwatch-france.timbenniks.dev/api/summary): ANSSI and CNIL national figures, plus counts derived from this list.
- [Sources](https://cyberwatch-france.timbenniks.dev/api/sources): every source, with the incidents citing it.
- [Patterns](https://cyberwatch-france.timbenniks.dev/api/patterns) and [recommendations](https://cyberwatch-france.timbenniks.dev/api/recommendations): the recurring weaknesses, and guidance for organisations and the public.
- [Raw dataset](https://cyberwatch-france.timbenniks.dev/data/france-cyberwatch-data.json): the complete file this site is built from.
- [Public explainers](https://cyberwatch-france.timbenniks.dev/learn): bilingual guides on what leaked data is used for. Incident facts still live only in the dataset; these pages link to records by id.
- [Leak-awareness quiz](https://cyberwatch-france.timbenniks.dev/learn/quiz): 16 questions from those guides. Educational copy only; no unpublished incident figures.
- [Full text for LLMs](https://cyberwatch-france.timbenniks.dev/llms-full.txt): every record as markdown. Add `?lang=fr` to this file, llms-full.txt, and feed.xml for French.

## Pages

- [Home](https://cyberwatch-france.timbenniks.dev/): what this dossier is, and the latest incidents.
- [Incidents](https://cyberwatch-france.timbenniks.dev/incidents): the full timeline, filterable by kind, severity, status, sector and year. Search lives here (?q=).
- [What people can do](https://cyberwatch-france.timbenniks.dev/guidance): public and organisation guidance.
- [Numbers](https://cyberwatch-france.timbenniks.dev/numbers): charts, national ANSSI/CNIL figures, patterns, the data table and sources.
- [Leak-awareness quiz](https://cyberwatch-france.timbenniks.dev/learn/quiz): a scored test of the public explainers.

- [DGFiP tax systems — 2026-08-14](https://cyberwatch-france.timbenniks.dev/incident/dgfip): Finance / tax, critical, confirmed. 678,000 individuals and businesses
- [Santé publique France contractor — 2026-08-13](https://cyberwatch-france.timbenniks.dev/incident/sante): Public health, high, confirmed. About 80,000 contact records
- [CEVA Logistics — 2026-07-29](https://cyberwatch-france.timbenniks.dev/incident/ceva): Logistics / supply chain, high, confirmed. Unknown person count; eight European warehouses
- [Education Ministry staff system — 2026-07-25](https://cyberwatch-france.timbenniks.dev/incident/edustaff): Education, critical, confirmed. A “significant number” of agents since 2001; exact count unpublished
- [France Titres / ANTS — 2026-04-15](https://cyberwatch-france.timbenniks.dev/incident/ants): Identity / public services, critical, confirmed. About 11.7 million accounts that may be concerned
- [Education Ministry / ÉduConnect — 2026-04-14](https://cyberwatch-france.timbenniks.dev/incident/edustudents): Education, critical, confirmed. Official pupil count unpublished
- [Education Ministry / COMPAS — 2026-03-15](https://cyberwatch-france.timbenniks.dev/incident/educompas): Education, high, confirmed. About 243,000 agents, trainees and permanent staff
- [DGFiP / FICOBA — 2026-01-31](https://cyberwatch-france.timbenniks.dev/incident/ficoba): Finance / tax, critical, confirmed. About 1.2 million bank accounts
- [French Interior Ministry — 2025-12-11](https://cyberwatch-france.timbenniks.dev/incident/interior): Law enforcement, critical, disputed. 72 TAJ files and tens of thousands of TAJ index rows; 23 FPR files and ~3,000 FPR index elements; 1 Interpol file — not a person count
- [Eurofiber France — 2025-11-13](https://cyberwatch-france.timbenniks.dev/incident/eurofiber): Telecom / cloud supplier, high, confirmed. Customer scope not expressed as a verified person count
- [Weda — 2025-11-10](https://cyberwatch-france.timbenniks.dev/incident/weda): Healthcare, critical, confirmed. 23,000 health professionals operationally locked out; patient count unknown
- [Air France / KLM — 2025-08-06](https://cyberwatch-france.timbenniks.dev/incident/airfrance): Aviation, high, confirmed. Number not publicly disclosed
- [Bouygues Telecom — 2025-08-04](https://cyberwatch-france.timbenniks.dev/incident/bouygues): Telecommunications, critical, confirmed. 6.4 million customer accounts
- [Orange — 2025-07-25](https://cyberwatch-france.timbenniks.dev/incident/orange): Telecommunications, high, confirmed. Limited business-related files later acknowledged stolen; no customer-person count

## Public explainers

Educational copy, not incident records. Do not treat these pages as a source of victim counts.

- [Why leaked data is useful to criminals](https://cyberwatch-france.timbenniks.dev/learn/why-leaks-matter): A data breach is not only a password problem. The details that leak are what make the next message or phone call look official.
- [Phishing that already knows you](https://cyberwatch-france.timbenniks.dev/learn/phishing-that-knows-you): After a leak, the dangerous message is the one that sounds informed. Names, addresses, contract numbers and loyalty IDs are the raw material.
- [What an IBAN leak lets someone do](https://cyberwatch-france.timbenniks.dev/learn/iban-and-banking): An IBAN in a stolen file is not a PIN. It is still dangerous, because it lets a stranger talk about your bank account as if they already belong in the conversation.
- [When the leaked file is a government one](https://cyberwatch-france.timbenniks.dev/learn/when-the-state-is-the-source): A message that sounds like the tax office, the identity-document service or the police is easier to believe. That is why those files are valuable to scammers.
- [Health, school, and why leaked data ages badly](https://cyberwatch-france.timbenniks.dev/learn/health-school-long-tail): Some leaks look small because they are not passwords. Contact details, absences, and records tied to health or school stay useful to criminals for a long time.
- [When a machine writes the scam](https://cyberwatch-france.timbenniks.dev/learn/ai-written-attacks): Language models do not understand you. They predict the next word. That is already enough to write fluent, personal-sounding messages at a scale no call centre can match, especially once a leak has supplied the facts.
- [Passwords, passkeys, and what to change after a leak](https://cyberwatch-france.timbenniks.dev/learn/passwords-after-a-leak): A leaked password is useful because people reuse it. A hash is still a reason to change it. A passkey is harder to phish than a code sent by SMS.

## National context

Not from the curated list above — these are France-wide figures from the cited authorities:

- ANSSI handled 3586 security events in 2025 (2209 reports, 1366 incidents); 42% of its 460 possible-leak events were confirmed.
- The CNIL received 6167 personal-data breach notifications in 2025, around 50% involving hacking.