Loading story…
Hackers breached the email servers of the French Ministry of the Interior, as confirmed by Interior Minister Laurent Nunez. The attack, detected between December 11 and 12, allowed threat actors to access certain document files, though there is no current evidence of serious data compromise. In response, the ministry has tightened security measures and reinforced access controls for all agents, while an investigation is underway to determine the origin and scope of the breach. Authorities are considering various scenarios, including foreign interference, hacktivism, or cybercrime, and have not yet released technical details about the attack.
Following the breach, there are indications that emails sent from the French Ministry of the Interior's domain were used to announce the reopening of BreachForums, a notorious cybercriminal marketplace. This suggests that the attackers may have leveraged their access to the ministry's email infrastructure for further malicious activity, potentially as part of a hacker honeypot or to lend credibility to their communications. The incident highlights the risks associated with compromised government email systems and the potential for such breaches to be exploited in broader cybercriminal operations.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
French authorities arrested a 22-year-old suspect on December 17, 2025, in connection with the cyberattack on the Interior Ministry. The investigation, led by the Office for Combating Cybercrime, remained ongoing as officials worked to determine whether others were involved and to verify the attackers' claims.
BreachForums' reopening was announced through emails sent from the French Interior Ministry's domain, raising concerns that the government email infrastructure had been compromised or abused for spoofing. The messages linked the ministry breach to the cybercriminal forum's return.
The Interior Ministry tightened security controls in response to the incident, including password changes, reinforced access restrictions, and deployment of two-factor authentication. Officials said the attack was being handled with the highest level of vigilance because of the sensitivity of the affected systems.
Following discovery and publicization of the breach, the ministry's cybersecurity center, ANSSI, and judicial authorities began investigations to determine the origin, scope, and impact of the intrusion. A data breach notification was also filed with France's data protection regulator, CNIL.
A user tied to the relaunched BreachForums forum claimed responsibility for the Interior Ministry hack, posted screenshots as alleged proof, and asserted the breach was retaliation for prior arrests of forum members. The actor also claimed access to highly sensitive French law enforcement data, though authorities did not verify those claims.
During the intrusion, attackers accessed dozens of confidential documents and may have used compromised email accounts to reach internal business applications. Officials said there was no confirmed evidence at that stage of major data theft or a ransom demand.
France's Ministry of the Interior detected a cyberattack affecting its internal email infrastructure between December 11 and 12, 2025. Attackers gained unauthorized access to several ministry email accounts and some document files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
6 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcetherecord.media
Open sourcesecurityonline.info
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The French Interior Ministry confirmed a cyberattack that compromised its email servers, allowing attackers to access certain document files. In response, the ministry implemented enhanced security protocols and access controls, while an investigation was launched to determine the origin and scope of the breach. Authorities have not yet confirmed whether any data was stolen, and are considering multiple possible motives, including foreign interference, hacktivism, or cybercrime. The Interior Ministry, which oversees police, internal security, and immigration, is considered a high-value target for both state-sponsored and criminal actors. The incident was reported in several news roundups, highlighting its significance within the broader context of European cybersecurity threats. While attribution has not been established for this specific attack, previous campaigns against French government entities have been linked to Russian state-sponsored groups such as APT28. The breach underscores ongoing concerns about the vulnerability of critical government infrastructure to sophisticated cyber threats and the need for robust incident response and investigation procedures.
Jun 29, 2026
French authorities are investigating a breach of **Tchap**, the encrypted messaging service used across the French public sector, after ANSSI detected suspicious activity tied to a compromised account and DINUM blocked the access. Officials said the confirmed exposure was limited to **public chat rooms** on an education-related Tchap shard, while private one-to-one and private group conversations remained protected by encryption. DINUM said it alerted users, notified France’s data protection authority **CNIL**, and is reviewing logs to determine what data may have been accessed or exfiltrated. A threat actor claimed the intrusion was achieved through **social engineering** and alleged far broader access than the government has confirmed, including roughly **643,000 messages** from **876 public rooms**, data tied to about **73,000 accounts**, media files, and possible references to documents marked **"Diffusion restreinte"**. Other unverified claims included theft of account data and hardcoded **LDAP** credentials, as well as weaknesses in file access controls. French officials have not validated those assertions and said the investigation is ongoing.
Jun 29, 2026
French education authorities disclosed two significant breaches affecting both public and Catholic school administration systems. The Ministry of National Education said its `Compass` platform, used to manage trainee teachers in primary and secondary education, was compromised after a user reportedly opened a fraudulent email attachment and had credentials stolen. The incident exposed data on about **243,000 people**, including identity and contact details, absence periods, and the identities and professional phone numbers of tutors, though the ministry said no health data was involved. ANSSI was brought in, a crisis cell was opened, and the ministry announced a security plan centered on **multi-factor authentication**, stronger data segmentation, and reduced application exposure. Separately, the Secrétariat général de l’enseignement catholique reported a cyberattack on its management application for nursery and elementary schools that affected about **1.5 million people**. Unauthorized access exposed identification data for application users and contact information for students, families, and teachers, including names, postal and email addresses, phone numbers, and dates of birth, increasing the risk of phishing. The organization said it secured access, suspended affected services, notified authorities including the French Ministry of Education, and engaged specialist responders, while a forum user calling themselves **"Ryolait"** allegedly offered the stolen database for sale starting at **$2,000**. The incidents add to mounting concern over weak security in the education sector, which ANSSI has described as a frequent target of opportunistic attacks.
Jun 29, 2026