France has the most data leaks per capita and the highest number of crypto kidnappings worldwide!
Even public agencies get breached weekly.
Yet lawmakers keep pushing for legislation to collect and centralize crypto users’ personal information in massive databases.
List of cyberattacks and data leaks affecting France’s public sector over the past year 👇
URSSAF / DPAE - Social security contributions and hiring declarations.
Up to 12 million employees: names, dates of birth, employers and employment start dates.
France Titres / ANTS - Identity documents and vehicle registration
Up to 11.7 million accounts potentially exposed: identity details, dates of birth, addresses and email addresses.
France Éducation international / GAEL - French language exams
5.8 million DELF-DALF candidates: identity details, nationalities, dates and places of birth.
Education Ministry
Up to 4.35 million teachers potentially affected: identity details, school assignments, ranks and allowances. Personal and family information on one million pupils in the Créteil education district was also stolen.
Pass’Sport / Sports Ministry - Sports participation subsidies
3.5 million households: names, addresses, phone numbers and other contact details.
Bloctel / DGCCRF - “Do Not Call” register and consumer protection authority
3 million phone numbers extracted, including 600,000 registered on Bloctel.
France Travail / Missions locales - Employment and youth support services
1.6 million young people: identity details, addresses, phone numbers and French social security numbers.
URSSAF / Pajemploi - Childcare payroll service
Up to 1.2 million employees: identity details, addresses, French social security numbers and the names of their banks.
CAF / CNAF / Vacaf - Family benefits and holiday assistance
Nearly 1.2 million case files allegedly compromised, with no confirmation from CNAF: family information, beneficiary details and holiday stays.
DGFiP / FICOBA - Tax authority and national bank account register
Around 1.2 million bank accounts: account holders’ identity details, addresses and bank account information, including IBANs.
Cnous / CROUS - Student services network
774,000 people: identity details, email addresses and appointment information. 329,000 documents relating to 139,000 people were also extracted, including identity documents and proof of income.
Parcoursup / Occitanie regional education authority - University admissions
705,000 applicants: identity and contact details, education records, student grant status and family information. The intrusion occurred in October 2025.
JeVeuxAider. gouv. fr - Government volunteering platform
550,000 accounts affected: names, email addresses, phone numbers, dates of birth and volunteering history.
Sports Ministry / FORÔMES
450,000 candidates: identity details, addresses, phone numbers, dates of birth and qualification levels.
DGFiP / Cadastre - Property register
Up to 433,485 individuals: property addresses and characteristics.
DGAFP / Choisir le service public - Civil service recruitment portal
377,418 applicants: identity and contact details, qualifications and employment histories.
DGFiP - Tax records
More than 350,000 individuals: household income figures used for tax purposes, family tax calculation details and income tax withholding rates.
ANFR / Maritime radio service - National radio frequencies agency
330,000 users: identity details, addresses, email addresses, phone numbers and dates of birth.
Education Ministry / COMPAS
243,000 staff: names, home addresses and initial job postings.
France Éducation international / Ev@lang
Up to 200,000 candidates: personal data associated with language tests.
ASP / Coup de pouce énergie - Public payments agency and energy assistance scheme.
108,555 beneficiaries: identity details, addresses, assistance amounts and IBANs.
Santé publique France / Contractor - National public health agency.
Around 80,000 contacts: names, professional email addresses, postal addresses and phone numbers. No medical data reported as exposed.
DINUM / HubEE - Government digital services directorate.
70,000 case files and 160,000 administrative documents stolen, some containing personal data.
AEFE / Orion - French schools abroad agency.
More than 30,000 people: directory entries, identity details and professional contact information.
Ecological Transition Ministry
22,000 staff and accredited organisations affected by access to personal data. More than 300 email accounts compromised.
INSEE - National statistics institute.
12,800 current and former staff: identity details and professional contact information.
IRD - Research Institute for Development.
Around 7,500 people: identity details, addresses, employment information and, in some cases, French social security numbers. Data exfiltration has not been confirmed.
Tracfin / Support provider - Financial intelligence unit.
136 professionals: identity and contact details, plus 213 support requests. No suspicious transaction reports were exposed, according to ANSSI, France’s cybersecurity agency.
ANSSI / Innovation Lab
118 Metabase accounts affected by a security breach.
14 local fire and rescue services (SDIS) targeted
Personal and professional data, internal files and medical documents.
At least 5 hospitals and hospital groups affected
AP-HP (Paris public hospitals), Hospices Civils de Lyon (Lyon public hospitals), Perpignan, Chaumont and Haute-Comté.
At least 30 sports federations affected
Football, shooting, tennis, gymnastics, swimming, sailing, skiing, handball and others. Data on registered members, including minors.
At least 8 public higher education institutions affected
Angers, Lille, UMLP, Alfort, Bordeaux Sciences Agro, AgroParisTech, Cnam and ésam.
Interior Ministry
Police investigation (TAJ), wanted persons (FPR), firearms (SIA) and vehicle registration (SIV) databases.
National Police
e-campus online training platform.
Education Ministry
ÉduConnect school login system.
DGFiP
Unclaimed estates portal.
Customs and Excise Directorate
Email systems and a server.
DINUM
Government cloud infrastructure.
Tchap
The government’s secure messaging service.
France Travail
Staff data held by an external HR provider.
France VAE - Accreditation of prior experience towards qualifications.
Applicant data.
Sports Ministry
Le Compte Asso, the government portal for nonprofit organisations.
Civic Service Agency
Training platform.
Campus France
Student application platforms.
CNRS - National Centre for Scientific Research.
Staff data.
French Biodiversity Agency (OFB)
Hunting licence data.
National Library of France and national monuments agency
External ticketing provider.
Regional health authorities (ARS)
Vaccination data.
French Office for Immigration and Integration (OFII)
External IT provider.
Source:
@Frenchbreaches @CerfiaFR