Loading story…
French authorities disclosed a security incident affecting Tchap, the Matrix-based messaging platform used by government staff and public institutions, after ANSSI detected suspicious activity tied to a compromised authenticated account. Officials said the account was rapidly disabled and an investigation began into whether messages, documents, or personal data were exposed; DINUM also notified CNIL because personal information may have been affected. Tchap, launched in 2018 and now used by more than 300,000 monthly users, was reportedly accessed through social engineering rather than a software flaw, according to a person claiming responsibility.
The incident revived long-standing concerns about Tchap’s access controls. Earlier public research showed the platform’s registration restrictions could be bypassed by manipulating the identity-verification flow and crafting an email value that appeared to match an authorized government domain, allowing unauthorized access to public rooms while posing as an @elysee.fr user. In the current breach, the attacker also alleged exposure of hardcoded LDAP credentials in a PowerShell script and claimed to have stolen more than 13 GB of data, including about 650,000 messages and records linked to over 73,000 users, though French officials are still verifying the scope of the compromise.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
A person claiming responsibility said the Tchap intrusion relied on social engineering rather than a software vulnerability and began from an account associated with Tchap's education-related environment. The claims also alleged exposure of hardcoded LDAP credentials and theft of more than 13 GB of data, including about 650,000 messages and records tied to more than 73,000 users.
French officials disclosed a security incident affecting Tchap after ANSSI detected suspicious activity linked to a compromised logged-in account. Authorities disabled the account, began reviewing possible exposure of messages, documents, and personal data, and DINUM notified CNIL over potential personal data exposure.
French officials said Tchap was launched in 2018 by DINUM with ANSSI and built on the Matrix framework for use by state employees and public institutions.
Bill Marczak published an analysis arguing that ToTok was closely connected to Abu Dhabi entities associated with Sheikh Tahnoon bin Zayed Al Nahyan, Group 42, and individuals tied to prior UAE surveillance operations. The report concluded that ToTok was likely an intelligence collection platform rather than conventional spyware.
A 2019 security analysis by Elliot Alderson found that Tchap's email-domain registration restriction could be bypassed by manipulating the requestToken request and using the Elysée identity server. The researcher created an account without legitimate government credentials and accessed Tchap public rooms while appearing as an Elysée employee.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcecitizenlab.ca
Open sourcemedium.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
French authorities are investigating a breach of **Tchap**, the encrypted messaging service used across the French public sector, after ANSSI detected suspicious activity tied to a compromised account and DINUM blocked the access. Officials said the confirmed exposure was limited to **public chat rooms** on an education-related Tchap shard, while private one-to-one and private group conversations remained protected by encryption. DINUM said it alerted users, notified France’s data protection authority **CNIL**, and is reviewing logs to determine what data may have been accessed or exfiltrated. A threat actor claimed the intrusion was achieved through **social engineering** and alleged far broader access than the government has confirmed, including roughly **643,000 messages** from **876 public rooms**, data tied to about **73,000 accounts**, media files, and possible references to documents marked **"Diffusion restreinte"**. Other unverified claims included theft of account data and hardcoded **LDAP** credentials, as well as weaknesses in file access controls. French officials have not validated those assertions and said the investigation is ongoing.
Jun 29, 2026
French education authorities disclosed two significant breaches affecting both public and Catholic school administration systems. The Ministry of National Education said its `Compass` platform, used to manage trainee teachers in primary and secondary education, was compromised after a user reportedly opened a fraudulent email attachment and had credentials stolen. The incident exposed data on about **243,000 people**, including identity and contact details, absence periods, and the identities and professional phone numbers of tutors, though the ministry said no health data was involved. ANSSI was brought in, a crisis cell was opened, and the ministry announced a security plan centered on **multi-factor authentication**, stronger data segmentation, and reduced application exposure. Separately, the Secrétariat général de l’enseignement catholique reported a cyberattack on its management application for nursery and elementary schools that affected about **1.5 million people**. Unauthorized access exposed identification data for application users and contact information for students, families, and teachers, including names, postal and email addresses, phone numbers, and dates of birth, increasing the risk of phishing. The organization said it secured access, suspended affected services, notified authorities including the French Ministry of Education, and engaged specialist responders, while a forum user calling themselves **"Ryolait"** allegedly offered the stolen database for sale starting at **$2,000**. The incidents add to mounting concern over weak security in the education sector, which ANSSI has described as a frequent target of opportunistic attacks.
Jun 29, 2026
France’s Interior Ministry disclosed a cyberattack on the National Agency for Secure Documents (**ANTS**) portal, `ants.gouv.fr`, the government platform used to manage passport, national ID card, residence permit, and driver’s license applications. Detected on April 15, the incident may have exposed personal data tied to individual and professional accounts, including login identifiers, names, email addresses, dates of birth, and account IDs, with some records also potentially containing postal addresses, places of birth, and phone numbers. Officials said uploaded administrative documents were not compromised and that the exposed data cannot be used to directly access ANTS accounts. French authorities reported the breach to **CNIL**, notified prosecutors, and alerted the national cybersecurity agency as investigators work to determine the scope, origin, and impact of the intrusion. The number of affected users has not been disclosed, but impacted individuals are being notified and urged to watch for suspicious messages. Separately, an unverified threat actor has claimed to be selling a dataset allegedly stolen from ANTS containing roughly **18–19 million** records, heightening concerns over identity theft and fraud if the claim is confirmed.
Jun 29, 2026