Loading story…
France has established REACTIV, an interministerial cyber incident-response mechanism that authorizes the National Agency for the Security of Information Systems (ANSSI) to require ministries to implement urgent technical safeguards within set deadlines and to centrally manage technical crisis communications. The measure is intended to protect government services and citizens’ data during major intrusions and breaches.
The initiative follows compromises at the Directorate-General for Public Finance (DGFiP) that reportedly exposed data on between 350,000 and 678,000 taxpayers, as well as an intrusion at the National Agency for Secure Documents (ANTS). Two alleged ZeroBytes members, aged 16 and 18, were arrested in late August in connection with the DGFiP attack. France also plans mandatory multifactor authentication for government administrators, broader deployment of hardware security keys, and a €200 million government IT-security architecture overhaul; REACTIV’s own staffing and funding remain undisclosed.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
ANSSI announced REACTIV, an interministerial mechanism enabling it to require ministries to take urgent protective measures and centrally lead technical crisis communications during cyber incidents affecting state services.
French authorities arrested two individuals, aged 16 and 18, on suspicion of involvement in the DGFiP hack as members of the ZeroBytes hacking group.
The French government reportedly directed administrations to improve cyber readiness within 15 days, approved a €200 million governmental IT-architecture overhaul, and required multifactor authentication for government system administrators before year-end. It also planned to issue hardware security keys to state employees and merge DINUM with DITP.
Following the DGFiP incident, France's Prime Minister requested an extensive audit of ANSSI and the creation of a new incident-response unit.
France's National Agency for Secure Documents (ANTS) was reportedly affected by a cyber intrusion amid wider incidents targeting public administration.
France's Directorate-General for Public Finance (DGFiP) suffered reported compromises, described as three compromises by one source, exposing sensitive and personal data for an estimated 350,000 to 678,000 taxpayers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecyber.gouv.fr
Open sourceinfosecurity-magazine.com
Open sourcezdnet.fr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A cyberattack on France’s tax authority, the **Direction générale des Finances publiques (DGFiP)**, led to the theft of taxpayer data and prompted Prime Minister **Sébastien Lecornu** to order the creation of a new ANSSI-backed cyber intervention team. Lecornu said too few ministries meet required cybersecurity standards and called on SGDSN secretary general **Nicolas Roche** to rapidly define the unit’s organization, rules of engagement, resources, and leadership so it can intervene before, during, and after serious incidents affecting state information systems. He described the threat environment as massive, organized, and hybrid, involving rival states, criminal networks, and isolated hackers that may act in coordination. The breach has also intensified political opposition to France’s mandatory electronic invoicing rollout, with critics arguing the state has not shown it can adequately protect sensitive data. DGFiP director **Amélie Verdier** said the stolen data is unrelated to the e-invoicing program and defended the reform’s security architecture, while the government kept the implementation timetable unchanged: all businesses must be able to receive electronic invoices from **1 September 2026**, with issuance requirements starting the same day for large companies and mid-sized firms, then extending to SMEs and microbusinesses on **1 September 2027**. A temporary grace period through the end of 2026 will spare good-faith companies from penalties, even as IT teams prepare integrations with one of **138** state-approved private invoicing platforms.
Aug 27, 2026
The French Interior Ministry confirmed a cyberattack that compromised its email servers, allowing attackers to access certain document files. In response, the ministry implemented enhanced security protocols and access controls, while an investigation was launched to determine the origin and scope of the breach. Authorities have not yet confirmed whether any data was stolen, and are considering multiple possible motives, including foreign interference, hacktivism, or cybercrime. The Interior Ministry, which oversees police, internal security, and immigration, is considered a high-value target for both state-sponsored and criminal actors. The incident was reported in several news roundups, highlighting its significance within the broader context of European cybersecurity threats. While attribution has not been established for this specific attack, previous campaigns against French government entities have been linked to Russian state-sponsored groups such as APT28. The breach underscores ongoing concerns about the vulnerability of critical government infrastructure to sophisticated cyber threats and the need for robust incident response and investigation procedures.
Jun 29, 2026
France’s Interior Ministry disclosed a cyberattack on the National Agency for Secure Documents (**ANTS**) portal, `ants.gouv.fr`, the government platform used to manage passport, national ID card, residence permit, and driver’s license applications. Detected on April 15, the incident may have exposed personal data tied to individual and professional accounts, including login identifiers, names, email addresses, dates of birth, and account IDs, with some records also potentially containing postal addresses, places of birth, and phone numbers. Officials said uploaded administrative documents were not compromised and that the exposed data cannot be used to directly access ANTS accounts. French authorities reported the breach to **CNIL**, notified prosecutors, and alerted the national cybersecurity agency as investigators work to determine the scope, origin, and impact of the intrusion. The number of affected users has not been disclosed, but impacted individuals are being notified and urged to watch for suspicious messages. Separately, an unverified threat actor has claimed to be selling a dataset allegedly stolen from ANTS containing roughly **18–19 million** records, heightening concerns over identity theft and fraud if the claim is confirmed.
Jun 29, 2026