France's national CERT was notified of 196 data exfiltration incidents in 2025, up from 130 it handled in 2024, and in most of the cases it worked on the attackers never had to exploit a software vulnerability. That is the central finding of an 80-page lessons-learned report published by CERT-FR, the incident response arm of the French cybersecurity agency ANSSI, on 20 October 2026.
Reused legitimate credentials, access obtained through social engineering, or data simply left exposed without access control: CERT-FR says these, not sophisticated exploits, are what drained personal and sometimes sensitive data out of web applications. It saw no particular targeting pattern. Any sector and any type of organization could be hit.
One stolen account, a whole database
The cases in the report show how little it took. In May 2025 an e-health provider lost part of its personal and medical data after an attacker took over a single user account and used it to reach an API that queried the company's database. In another 2025 case, one compromised account was enough to pull, through a poorly restricted API, records that the user had no legitimate right to see.
Infostealers, malware that harvests saved browser passwords and session cookies, recur throughout. In February 2025 several agri-food companies suffered data breaches after employees installed a free tool posing as a Word-to-PDF converter. According to CERT-FR, it exfiltrated every document users uploaded and produced output files that installed the malware when opened, so it spread further. Late in 2025 the agency also handled several thefts from public services made possible by infostealers on citizens' own home computers, and ANSSI dealt with a medical laboratory whose test results leaked after a contractor's account for the results-viewing application was compromised.
Many of these thefts are then claimed on cybercrime forums or Telegram. CERT-FR cautions that such claims may be false or recycled from older leaks, but says the data owner must still investigate each one.
Old applications, modern threat levels
The agency's diagnosis is that many applications were built before GDPR changed thinking about which data counts as sensitive, replacements move slowly in both public and private organizations, and many teams underestimate what an attacker can do with a valid login and password. Its threat scenarios also include insiders, among them former staff whose accounts were never revoked, and cloud storage misconfigured so that the whole internet can reach it.
Ten fixes that work without a rewrite
The report stresses that it is not a guide and does not replace privacy by design. These are measures CERT-FR actually deployed during incident response to stop repeat breaches on existing systems, grouped into ten categories:
- apply a data management policy, steered by senior leadership;
- apply least privilege and cap the volume of data a single session can reach;
- limit exposure, and treat traffic as internal only if it comes from a network under your own security policy;
- move beyond login and password, with strong authentication for staff and one-time codes or passkeys for the public;
- secure the hosting environment in line with ANSSI guidance;
- log every action so it can be tied to a user and a network address;
- review those logs for anomalies, at minimum periodically;
- throttle authentication attempts and block sensitive functions for risky sessions;
- test application security before go-live and over time, including a software bill of materials;
- for public administrations, formally accredit each application under France's RGS and PSSIE frameworks.
Technical annexes show how to apply several of these at the reverse proxy or web application firewall layer, including geo-filtering, connection-hour limits, and caps on the number of requests over a sliding time window to slow bulk extraction. The full report is in French and follows a 2024 edition limited to the social sector. It lands weeks after France counted 99 reported data breaches at state services; see our France profile for wider context.
The message CERT-FR wants to land is that most of these compromises were avoidable, and that even ageing applications can be made drastically harder to drain without waiting years for their replacement.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.