Loading story…
La Poste, France's national postal service, experienced a major disruption after a distributed denial-of-service (DDoS) attack knocked its information systems offline, affecting millions of customers. The incident rendered the main website, mobile app, digital identity service, and Digiposte document storage platform temporarily inaccessible, while also impacting La Banque Postale's online and mobile banking services. Despite the outage, core banking operations such as ATM withdrawals, in-store card payments, and transfers via WERO remained functional, with online payments still possible through SMS authentication. Some physical post office locations operated at reduced capacity, but counter services for banking and postal transactions continued.
The disruption occurred just days before Christmas, leading to delays in parcel deliveries and customer complaints about the potential for missed holiday packages. La Poste stated there was no evidence of customer data compromise and did not attribute the attack to any specific group. The company has not provided a timeline for full service restoration, but teams are working to resolve the issue. The incident follows a separate data breach at France’s Interior Ministry, though there is no indication the two events are connected.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
French authorities, including the DGSI and the Paris prosecutor's office, launched an investigation into the attack after the disruption and subsequent claim of responsibility. The inquiry is examining the incident as part of a broader pattern of pro-Russian DDoS activity targeting European organizations.
By 2025-12-26, the pro-Russian hacktivist group NoName057(16) publicly claimed responsibility for the DDoS attack on La Poste and La Banque Postale. The claim provided a possible attribution, though official confirmation of the group's role had not been established in earlier reporting.
Following the outage, La Poste said it had found no evidence of customer data compromise and began working to restore affected services. Essential functions such as in-person counter services, card payments, and ATM withdrawals remained available, though some offices operated at reduced capacity and online payment authentication shifted to SMS workarounds.
On 2025-12-22, France's national postal service La Poste experienced a major cyber incident, widely reported as a distributed denial-of-service attack, that took key information systems offline. The disruption affected its website, mobile app, digital identity service, Digiposte platform, parcel-related services, and La Banque Postale's online and mobile banking.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
7 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcetherecord.media
Open sourcetechrepublic.com
Open sourcesecurityaffairs.com
Open sourcetechcrunch.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A suspected cyberattack disrupted services at **La Poste**, France’s state-owned postal operator, affecting both postal operations and its banking subsidiary, **La Banque Postale**. The incident caused outages across customer-facing systems and internal services, prompting the company to activate response measures while working to restore operations and assess the scope of the intrusion. Two days after the disruption became public, a **pro-Russian hacking group** claimed responsibility for the attack, escalating concerns that the incident may have been politically motivated rather than ordinary cybercrime. French authorities and the company continued investigating the breach and its impact, while the claim added to broader worries about hostile cyber activity targeting critical national services in France.
Jul 12, 2026
France’s Ministry of the Economy and Finance confirmed that an attacker **accessed and consulted data tied to ~1.2 million French bank accounts** by using **stolen login credentials** belonging to an authorized government user of the national bank account registry (*FICOBA*). The intrusion began in **late January 2026** and exposed account-linked personal data including **IBANs**, account holder **names**, **addresses**, and in some cases **tax identification numbers** (DGFiP-issued). Authorities stated the access did **not** enable viewing balances or initiating transactions. After detection, the ministry reported it **blocked the attacker**, notified France’s data protection authority (**CNIL**), and **filed a criminal complaint**; impacted individuals are expected to be contacted directly, and **banks were alerted** to advise customers to remain vigilant. Reporting noted the incident follows other recent cyber disruptions affecting French public services (including attacks impacting **La Poste/La Banque Postale** and the **Interior Ministry**), though no motive or attribution for the FICOBA access has been publicly confirmed.
Jun 29, 2026
The French Interior Ministry confirmed a cyberattack that compromised its email servers, allowing attackers to access certain document files. In response, the ministry implemented enhanced security protocols and access controls, while an investigation was launched to determine the origin and scope of the breach. Authorities have not yet confirmed whether any data was stolen, and are considering multiple possible motives, including foreign interference, hacktivism, or cybercrime. The Interior Ministry, which oversees police, internal security, and immigration, is considered a high-value target for both state-sponsored and criminal actors. The incident was reported in several news roundups, highlighting its significance within the broader context of European cybersecurity threats. While attribution has not been established for this specific attack, previous campaigns against French government entities have been linked to Russian state-sponsored groups such as APT28. The breach underscores ongoing concerns about the vulnerability of critical government infrastructure to sophisticated cyber threats and the need for robust incident response and investigation procedures.
Jun 29, 2026