CERT-FR Issues Web Application Security Guidance After Tracking Nearly 200 Data Breaches

CERT-FR published lessons learned from nearly 200 data breaches involving web applications that it tracked in 2025. Many incidents involved low-complexity attacker actions without exploitation of a technical vulnerability. The agency warned that exposed information can directly harm individuals and enable fraud campaigns using precise, personalized data.

Drawing on incident-response experience, CERT-FR outlined ten short- and medium-term approaches to reduce risk in existing web applications handling sensitive data. The guidance combines security principles with technical implementation examples, focusing on preventing recurring breaches rather than establishing an exhaustive long-term security baseline. Security leaders responsible for sensitive web applications can use it to inform near-term remediation priorities.