French Bank Account Registry Breach Exposes 1.2 Million Accounts France’s Ministry of Economy confirmed a data breach on Wednesday, revealing that a threat actor accessed the national bank account registry, FICOBA, compromising 1.2 million accounts. The attacker exploited stolen credentials belonging to a government official to infiltrate the database, which stores details on all bank accounts opened in France. The breach, detected in late January, exposed sensitive information including IBANs, account holder names, addresses, and in some cases tax identifiers. While the attacker could not perform banking operations or view account balances, officials warned of potential phishing and scam risks for affected individuals. Access has since been revoked, and impacted users are being notified. Cybersecurity experts highlighted the incident as a cautionary example of overprivileged access. Michael Jepson, Penetration Testing Manager at CybaVerse, noted that allowing broad data access via a single identity particularly for high-ranking officials creates structural vulnerabilities. He emphasized that modern security practices should enforce least-privilege access, restricting permissions based on operational necessity rather than seniority. The breach follows recent cyber incidents in France, including disruptions to the postal service and banking sector during the 2023 Christmas rush, as well as a separate attack on Eurofiber France. The incident underscores the growing risks of credential-based attacks on critical financial infrastructure.