France Faces Unprecedented Surge in Data Breaches as Cybersecurity Gaps Persist France is grappling with a historic wave of data breaches, with cyberattacks and accidental leaks exposing millions of individuals across both public and private sectors. According to a May 19 report from the National Commission for Information Technology and Civil Liberties (CNIL), 6,167 data breaches were reported in 2024 a 10% increase from the previous year with nearly half attributed to hacking. The scale of the crisis is staggering: over the past two years, roughly 80 breaches have each impacted at least one million people. Targets have included critical government agencies, such as the Interior and Economy Ministries, the National Agency for Secured Documents, and the national employment agency, as well as major corporations like telecom provider Free and supermarket chain Auchan. Private health insurers and labor unions have also been hit. The surge has overwhelmed authorities, with Johanna Brousse, deputy prosecutor and head of the Paris prosecutor’s cybercrime unit, reporting an "explosion" in investigations sometimes as many as 10 per week. While some breaches stem from single incidents affecting multiple entities (e.g., a compromised service provider), roughly half of CNIL’s notifications involve deliberate cyberattacks, with the remainder resulting from accidental exposures. As 2025 shapes up to surpass previous records, the trend underscores persistent vulnerabilities in France’s cybersecurity defenses across industries.

French FICOBA Bank Registry Breach Exposes 1.2M Accounts in SEPA Fraud Risk Hackers breached France’s FICOBA (Fichier national des comptes bancaires et assimilés), a state-run registry tracking all bank accounts in the country, stealing sensitive data on 1.2 million accounts. The attack, confirmed by the French Ministry of Finance, originated from stolen login credentials belonging to a civil servant, granting unauthorized access to the database. The compromised data includes bank account details (RIBs and IBANs), account holder identities, postal addresses, and in some cases, taxpayer identification numbers. This information poses a significant risk for SEPA (Single Euro Payments Area) direct debit fraud, where attackers can initiate unauthorized transactions using victims’ IBANs. While banks can reverse fraudulent debits, affected individuals may still face financial losses and administrative burdens. Authorities detected the breach and temporarily took FICOBA offline before restoring access. The registry is now operational, and affected users are being notified individually. Reports indicate that phishing campaigns via email and SMS have already emerged, targeting victims with fraudulent schemes. The incident underscores the growing threat of financial fraud enabled by large-scale data breaches, particularly in systems tied to critical banking infrastructure. No details on the attackers’ identity or the success rate of follow-up scams have been disclosed.