France has the most data leaks per capita and the highest number of crypto kidnappings worldwide! Even public agencies get breached weekly. Yet lawmakers keep pushing for legislation to collect and centralize crypto users’ personal information in massive databases. List of cyberattacks and data leaks affecting France’s public sector over the past year 👇 URSSAF / DPAE - Social security contributions and hiring declarations. Up to 12 million employees: names, dates of birth, employers and employment start dates. France Titres / ANTS - Identity documents and vehicle registration Up to 11.7 million accounts potentially exposed: identity details, dates of birth, addresses and email addresses. France Éducation international / GAEL - French language exams 5.8 million DELF-DALF candidates: identity details, nationalities, dates and places of birth. Education Ministry Up to 4.35 million teachers potentially affected: identity details, school assignments, ranks and allowances. Personal and family information on one million pupils in the Créteil education district was also stolen. Pass’Sport / Sports Ministry - Sports participation subsidies 3.5 million households: names, addresses, phone numbers and other contact details. Bloctel / DGCCRF - “Do Not Call” register and consumer protection authority 3 million phone numbers extracted, including 600,000 registered on Bloctel. France Travail / Missions locales - Employment and youth support services 1.6 million young people: identity details, addresses, phone numbers and French social security numbers. URSSAF / Pajemploi - Childcare payroll service Up to 1.2 million employees: identity details, addresses, French social security numbers and the names of their banks. CAF / CNAF / Vacaf - Family benefits and holiday assistance Nearly 1.2 million case files allegedly compromised, with no confirmation from CNAF: family information, beneficiary details and holiday stays. DGFiP / FICOBA - Tax authority and national bank account register Around 1.2 million bank accounts: account holders’ identity details, addresses and bank account information, including IBANs. Cnous / CROUS - Student services network 774,000 people: identity details, email addresses and appointment information. 329,000 documents relating to 139,000 people were also extracted, including identity documents and proof of income. Parcoursup / Occitanie regional education authority - University admissions 705,000 applicants: identity and contact details, education records, student grant status and family information. The intrusion occurred in October 2025. JeVeuxAider. gouv. fr - Government volunteering platform 550,000 accounts affected: names, email addresses, phone numbers, dates of birth and volunteering history. Sports Ministry / FORÔMES 450,000 candidates: identity details, addresses, phone numbers, dates of birth and qualification levels. DGFiP / Cadastre - Property register Up to 433,485 individuals: property addresses and characteristics. DGAFP / Choisir le service public - Civil service recruitment portal 377,418 applicants: identity and contact details, qualifications and employment histories. DGFiP - Tax records More than 350,000 individuals: household income figures used for tax purposes, family tax calculation details and income tax withholding rates. ANFR / Maritime radio service - National radio frequencies agency 330,000 users: identity details, addresses, email addresses, phone numbers and dates of birth. Education Ministry / COMPAS 243,000 staff: names, home addresses and initial job postings. France Éducation international / Ev@lang Up to 200,000 candidates: personal data associated with language tests. ASP / Coup de pouce énergie - Public payments agency and energy assistance scheme. 108,555 beneficiaries: identity details, addresses, assistance amounts and IBANs. Santé publique France / Contractor - National public health agency. Around 80,000 contacts: names, professional email addresses, postal addresses and phone numbers. No medical data reported as exposed. DINUM / HubEE - Government digital services directorate. 70,000 case files and 160,000 administrative documents stolen, some containing personal data. AEFE / Orion - French schools abroad agency. More than 30,000 people: directory entries, identity details and professional contact information. Ecological Transition Ministry 22,000 staff and accredited organisations affected by access to personal data. More than 300 email accounts compromised. INSEE - National statistics institute. 12,800 current and former staff: identity details and professional contact information. IRD - Research Institute for Development. Around 7,500 people: identity details, addresses, employment information and, in some cases, French social security numbers. Data exfiltration has not been confirmed. Tracfin / Support provider - Financial intelligence unit. 136 professionals: identity and contact details, plus 213 support requests. No suspicious transaction reports were exposed, according to ANSSI, France’s cybersecurity agency. ANSSI / Innovation Lab 118 Metabase accounts affected by a security breach. 14 local fire and rescue services (SDIS) targeted Personal and professional data, internal files and medical documents. At least 5 hospitals and hospital groups affected AP-HP (Paris public hospitals), Hospices Civils de Lyon (Lyon public hospitals), Perpignan, Chaumont and Haute-Comté. At least 30 sports federations affected Football, shooting, tennis, gymnastics, swimming, sailing, skiing, handball and others. Data on registered members, including minors. At least 8 public higher education institutions affected Angers, Lille, UMLP, Alfort, Bordeaux Sciences Agro, AgroParisTech, Cnam and ésam. Interior Ministry Police investigation (TAJ), wanted persons (FPR), firearms (SIA) and vehicle registration (SIV) databases. National Police e-campus online training platform. Education Ministry ÉduConnect school login system. DGFiP Unclaimed estates portal. Customs and Excise Directorate Email systems and a server. DINUM Government cloud infrastructure. Tchap The government’s secure messaging service. France Travail Staff data held by an external HR provider. France VAE - Accreditation of prior experience towards qualifications. Applicant data. Sports Ministry Le Compte Asso, the government portal for nonprofit organisations. Civic Service Agency Training platform. Campus France Student application platforms. CNRS - National Centre for Scientific Research. Staff data. French Biodiversity Agency (OFB) Hunting licence data. National Library of France and national monuments agency External ticketing provider. Regional health authorities (ARS) Vaccination data. French Office for Immigration and Integration (OFII) External IT provider. Source: @Frenchbreaches @CerfiaFR

Thanks to everyone who stopped by our booth at BTCHEL in Helsinki! 🇫🇮 It was a pleasure to catch up with familiar faces, meet new people and talk about Bitcoin in person. A big shoutout to @btcbenchmark and the @btchelevent team for bringing us all together!

Another day, another French public-sector data leak. But the administration is telling us that the automatic reporting of crypto users' data, which is supposed to start next year will be safe... Learn more about our legal challenge against Dac8: DAC8.COM