France Faces Unprecedented Surge in Data Breaches as Cybersecurity Gaps Persist France is grappling with a historic wave of data breaches, with cyberattacks and accidental leaks exposing millions of individuals across both public and private sectors. According to a May 19 report from the National Commission for Information Technology and Civil Liberties (CNIL), 6,167 data breaches were reported in 2024 a 10% increase from the previous year with nearly half attributed to hacking. The scale of the crisis is staggering: over the past two years, roughly 80 breaches have each impacted at least one million people. Targets have included critical government agencies, such as the Interior and Economy Ministries, the National Agency for Secured Documents, and the national employment agency, as well as major corporations like telecom provider Free and supermarket chain Auchan. Private health insurers and labor unions have also been hit. The surge has overwhelmed authorities, with Johanna Brousse, deputy prosecutor and head of the Paris prosecutor’s cybercrime unit, reporting an "explosion" in investigations sometimes as many as 10 per week. While some breaches stem from single incidents affecting multiple entities (e.g., a compromised service provider), roughly half of CNIL’s notifications involve deliberate cyberattacks, with the remainder resulting from accidental exposures. As 2025 shapes up to surpass previous records, the trend underscores persistent vulnerabilities in France’s cybersecurity defenses across industries.

French retail giant Auchan suffered a cyberattack in August 2025, resulting in the theft of loyalty account data from several hundred thousand customers. Attackers accessed personal information, including names, postal/email addresses, phone numbers, and loyalty card numbers, though financial data (bank details, PINs, and loyalty balances) remained secure. The breach was detected and contained promptly, with notifications sent to affected customers and France’s data protection authority (CNIL). This marks Auchan’s second major breach in a year, following a similar November 2024 incident targeting loyalty program data. While no passwords or payment credentials were compromised, the stolen data poses risks for targeted phishing attacks or underground sale. Auchan has implemented multi-factor authentication, enhanced network monitoring, and employee cybersecurity training, alongside offering free credit monitoring to impacted customers. Authorities are investigating the attack’s origin, while consumers are warned to stay vigilant against fraudulent communications.