Loading story…
French authorities are investigating a breach of Tchap, the encrypted messaging service used across the French public sector, after ANSSI detected suspicious activity tied to a compromised account and DINUM blocked the access. Officials said the confirmed exposure was limited to public chat rooms on an education-related Tchap shard, while private one-to-one and private group conversations remained protected by encryption. DINUM said it alerted users, notified France’s data protection authority CNIL, and is reviewing logs to determine what data may have been accessed or exfiltrated.
A threat actor claimed the intrusion was achieved through social engineering and alleged far broader access than the government has confirmed, including roughly 643,000 messages from 876 public rooms, data tied to about 73,000 accounts, media files, and possible references to documents marked "Diffusion restreinte". Other unverified claims included theft of account data and hardcoded LDAP credentials, as well as weaknesses in file access controls. French officials have not validated those assertions and said the investigation is ongoing.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
French authorities disclosed that the Tchap breach affected 73,467 public-sector employees, representing less than 9% of registered users. DINUM said the exposure involved data from unencrypted public chat rooms, including possible names, email addresses, avatar images, and affiliated organizations.
French authorities opened a criminal investigation into the Tchap intrusion, with the Paris prosecutor assigning the Office anti-cybercriminalité (Ofac) to investigate suspected unauthorized access and misuse of personal data in a state-run system.
DINUM disclosed that Tchap had been breached via a compromised account and said the confirmed exposure was limited to non-encrypted public chat rooms, while private conversations remained protected by encryption. Authorities said they were still assessing what was accessed or exfiltrated.
A threat actor publicly claimed the intrusion was achieved through social engineering of a valid account on an education-related Tchap shard, enabling access to public chat rooms. The actor alleged theft of messages, files, account data, and other material, though French authorities had not verified the broader claims.
French officials notified CNIL because personal information may have been exposed through accessible conversations, and DINUM said users were alerted about the incident. These actions were part of the official response to the Tchap breach.
After the compromise was identified, DINUM blocked the originating account and began reviewing logs to determine what data may have been accessed or exfiltrated. DINUM also said the incident may have exposed personal data in conversations.
French authorities said ANSSI detected suspicious activity involving a compromised Tchap user account on June 7, triggering the incident response. The compromise was tied to an account hijacking on the French government messaging platform.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
10 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcebleepingcomputer.com
Open sourcexakep.ru
Open sourcezdnet.fr
Open sourcehelpnetsecurity.com
Open sourcetheregister.com
Open sourcebleepingcomputer.com
Open sourcezdnet.fr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
French authorities disclosed a security incident affecting **Tchap**, the Matrix-based messaging platform used by government staff and public institutions, after ANSSI detected suspicious activity tied to a compromised authenticated account. Officials said the account was rapidly disabled and an investigation began into whether messages, documents, or personal data were exposed; DINUM also notified CNIL because personal information may have been affected. Tchap, launched in 2018 and now used by more than 300,000 monthly users, was reportedly accessed through **social engineering rather than a software flaw**, according to a person claiming responsibility. The incident revived long-standing concerns about Tchap’s access controls. Earlier public research showed the platform’s registration restrictions could be bypassed by manipulating the identity-verification flow and crafting an email value that appeared to match an authorized government domain, allowing unauthorized access to public rooms while posing as an **`@elysee.fr`** user. In the current breach, the attacker also alleged exposure of hardcoded LDAP credentials in a PowerShell script and claimed to have stolen more than **13 GB** of data, including about **650,000 messages** and records linked to over **73,000 users**, though French officials are still verifying the scope of the compromise.
Jul 12, 2026
French education authorities disclosed two significant breaches affecting both public and Catholic school administration systems. The Ministry of National Education said its `Compass` platform, used to manage trainee teachers in primary and secondary education, was compromised after a user reportedly opened a fraudulent email attachment and had credentials stolen. The incident exposed data on about **243,000 people**, including identity and contact details, absence periods, and the identities and professional phone numbers of tutors, though the ministry said no health data was involved. ANSSI was brought in, a crisis cell was opened, and the ministry announced a security plan centered on **multi-factor authentication**, stronger data segmentation, and reduced application exposure. Separately, the Secrétariat général de l’enseignement catholique reported a cyberattack on its management application for nursery and elementary schools that affected about **1.5 million people**. Unauthorized access exposed identification data for application users and contact information for students, families, and teachers, including names, postal and email addresses, phone numbers, and dates of birth, increasing the risk of phishing. The organization said it secured access, suspended affected services, notified authorities including the French Ministry of Education, and engaged specialist responders, while a forum user calling themselves **"Ryolait"** allegedly offered the stolen database for sale starting at **$2,000**. The incidents add to mounting concern over weak security in the education sector, which ANSSI has described as a frequent target of opportunistic attacks.
Jun 29, 2026
Hackers breached the email servers of the French Ministry of the Interior, as confirmed by Interior Minister Laurent Nunez. The attack, detected between December 11 and 12, allowed threat actors to access certain document files, though there is no current evidence of serious data compromise. In response, the ministry has tightened security measures and reinforced access controls for all agents, while an investigation is underway to determine the origin and scope of the breach. Authorities are considering various scenarios, including foreign interference, hacktivism, or cybercrime, and have not yet released technical details about the attack. Following the breach, there are indications that emails sent from the French Ministry of the Interior's domain were used to announce the reopening of BreachForums, a notorious cybercriminal marketplace. This suggests that the attackers may have leveraged their access to the ministry's email infrastructure for further malicious activity, potentially as part of a hacker honeypot or to lend credibility to their communications. The incident highlights the risks associated with compromised government email systems and the potential for such breaches to be exploited in broader cybercriminal operations.
Jun 29, 2026