A blow to the French banking system: Data breach affecting 1.2 million accounts.
France’s national database of bank accounts has suffered a major security breach, with two hackers gaining access to the data of 1.2 million accounts, including RIB and IBAN, since the end of January 2026, by exploiting employee login credentials and the absence of a two-factor authentication system to secure the accounts. The French Ministry of Economy revealed that investigations conducted by the Directorate General of Public Finances had uncovered "unauthorized access to the national file of bank accounts." This file contains all bank accounts held at French financial institutions, according to the French digital news site 01.net. data breach
The attacker was able to access personal information associated with the accounts, such as the account holder’s name, address, bank account details (RIB and IBAN), and in some cases, their tax ID. This data is extremely valuable for cyber fraud operations, such as phishing attacks, while the General Directorate of Public Finance confirmed that the file does not contain account balances and does not allow any financial transactions.
Poor management caused the breach
Hackers exploited the account of an employee who had access to information exchange between ministries, having previously obtained his login credentials. The lack of two-factor authentication at the Ministry of Economy facilitated the breach. Immediate measures to restrict access were taken as soon as the breach was discovered, and those affected are expected to be notified soon in accordance with French law, while the National Commission for Information and Freedoms has been informed and a complaint has been filed with the relevant authorities.
Bank procedures and warnings to citizens
The Ministry of Economy contacted banks to alert customers and urge them to exercise caution, with support from entities such as the National Information Systems Security Agency to enhance system security. The administration warned citizens against any messages requesting account login credentials or bank card numbers, emphasizing that it "will never request them." For its part, the French Banking Union called on those affected to closely monitor their accounts, especially transactions related to SEPA withdrawals, because fraudsters may use IBAN and other RIB data to carry out illegal withdrawals, pretending to be real companies and forging the account holder's signature.
This breach comes in the context of a series of cyberattacks targeting several French institutions in recent weeks, including government services and ministries, among them the Ministry of the Interior, reflecting the growing cybersecurity threats to official bodies.
0 Comments