France’s Constitutional Council blocked an under-15 social media ban, raising questions over free expression, age verification and online privacy.

The post France’s Top Court Blocks Under-15 Social Media Ban appeared first on TechRepublic.

France’s tax authority confirmed a cyberattack exposed taxpayer data as officials investigate the breach’s scope and an unverified 678,000-record claim.

The post Nearly 700,000 French Taxpayer Records Reportedly Stolen in Government Cyberattack appeared first on TechRepublic.

France’s tax agency says hackers stole data on 678,000 taxpayers, including income and tax details, in a sophisticated cyberattack.

A threat actor claimed to have breached France’s tax agency in late June. France’s tax administration confirmed that a cyberattack exposed personal data of 678,000 individuals and businesses, prompting an immediate criminal investigation. The cybercrime unit of the Paris Public Prosecutor’s Office has opened a probe and handed it to OFAC, France’s dedicated cybercrime fighting office. Tax officials described the attack as more sophisticated than anything they’d faced before.

“The attack allowed hackers to extract data relating to 678,000 users of France’s tax system, including both private individuals and companies.” reports French media RFI. “Tax authorities said the incident was more complex than cyberattacks they had faced in the past, potentially renewing concerns over the security of government information systems following a series of recent breaches involving other public bodies.”

The Directorate-General for Public Finances (DGFiP) stressed that the stolen data doesn’t grant access to taxpayers’ secure accounts on impots.gouv.fr. That’s a meaningful distinction, but income figures, tax rates, and family circumstances are exactly what an attacker needs to make a phishing email or phone call sound credible enough to extract a password or bank account number.

“Officials said those affected would be contacted from early next week, with particular emphasis on alerting them to the potential risk of identity theft and fraudulent attempts to obtain further personal information.” continues RFI.

French authorities did not disclose technical details about the cyberattack or its motivation.

The breach follows recent attacks on systems linked to ANTS, the national secure documents agency, and INSEE, France’s statistics authority. Three government bodies hit in quick succession is a pattern, not a coincidence.

For businesses, the exposed data was considered less sensitive, SIREN registration numbers, business addresses, and the address of the authorized representative. Public Accounts Minister David Amiel has asked the DGFiP to start notifying affected taxpayers from Monday and requested proposals on how to strengthen security procedures.

Investigators still need to establish how the attackers got in, who they are, and whether the data has already been sold or used. Anyone contacted about this breach should treat follow-up requests for passwords or banking information as fraudulent regardless of how official they sound.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, France’s tax agency)

Note The July 2026 Dark Web Breach Incident Trend Report was compiled based on data breach cases posted on deep web and dark web forums. Due to the nature of some posts, it is difficult to fully verify their accuracy; some posts related to South Korea included AI-generated false data or cases where it could […]

France will ban social media for children under 15, requiring nationwide age checks and raising privacy and platform compliance concerns.

The post France Bans Social Media for Under-15s, Requires Age Checks appeared first on TechRepublic.

France is accelerating its transition to post-quantum encryption:

France’s cybersecurity agency ANSSI said on Tuesday it would stop certifying security products that lack quantum-resistant encryption, a move that will force government bodies and critical operators to shift away from older systems.

Samih Souissi, ANSSI’s chief of staff, said at the France Quantum conference that the agency would halt such certifications from 2027, and that businesses should be buying only quantum-safe products by 2030.

ANSSI approval is required for use in French government agencies and critical infrastructure, making the policy a de facto phase-out of older encryption.

ASEC Blog publishes Ransom & Dark Web Issues Week 2, June 2026         Black X Ransomware Attacks on Korean and U.S. Organizations Data from South Korean Education Platform Leaked on BreachForums by Hasan Breach of French Secure Government Messaging Data Discovered on PwnForums

Scammers are mailing fake Ledger phishing letters to users in Italy with QR codes that trick crypto wallet users into revealing seed phrases.

French police arrest HexDex hacker, a 20-year-old suspect accused of mass data theft and leaks targeting government, sports groups, and firms.

The ANTS data breach has brought renewed attention to data security risks in France’s public sector after authorities confirmed a security incident affecting the ants.gouv.fr portal. The breach was detected on April 15, 2026, by the National Agency for Secure Documents and may have led to the exposure of personal data linked to both individual and professional accounts. According to initial findings, the compromised data includes identification details such as login IDs, names, email addresses, dates of birth, and unique account identifiers. In some cases, additional information such as postal addresses, place of birth, and phone numbers may also be involved. Affected users are being notified directly as investigations continue.

ANTS Data Breach Limited in Scope But Raises Phishing Risks

Authorities have clarified that the ANTS data breach does not involve documents submitted during administrative procedures, including uploaded attachments. The exposed data also cannot be used to directly access user accounts on the portal. However, the nature of the data still presents potential risks. Personal identifiers can be leveraged in targeted phishing campaigns or identity misuse attempts. Users have been advised to remain cautious when receiving unsolicited emails, calls, or messages claiming to be from official sources. The agency also warned that any attempt to distribute or sell data presented as originating from ANTS would be considered illegal.

Regulatory Response and Investigation Underway

In line with regulatory requirements, the ANTS data breach has been reported to the National Commission for Information Technology and Civil Liberties under Article 33 of the General Data Protection Regulation. A separate report has been submitted to the Paris Public Prosecutor under Article 40 of the French Code of Criminal Procedure to support a formal investigation. The National Cybersecurity Agency of France has also been notified and is working alongside ANTS to determine the origin, timeline, and full scope of the incident. Technical investigations are ongoing, with authorities focusing on how the breach occurred and whether additional systems were affected. Security measures have already been reinforced to protect user data and ensure service continuity on the platform.

EduConnect Cyberattack Shows How Identity Misuse Enables Access

The ANTS data breach follows closely on the heels of another incident involving France’s education systems. A cyberattack targeting the EduConnect platform stemmed from the impersonation of an authorized staff account in late 2025. Attackers exploited a vulnerability in a connected student account management service shortly before it was patched. This allowed unauthorized access to student data, including names, login identifiers, class information, and in some cases email addresses and activation codes. Investigations later confirmed that the scope extended beyond the initially targeted institution. In response to EduConnect cyberattack, the ministry reset access codes for unactivated accounts, blocked compromised credentials, and introduced two-factor authentication. A crisis response team was also activated, and access to the affected service was temporarily suspended. The case highlights how compromised credentials can be used to bypass controls without triggering immediate detection.

FICOBA Breach Exposed Financial Data Through Stolen Credentials

Earlier this year, another major France data breach involved the FICOBA database, a centralized registry that tracks all bank accounts in the country. The FICOBA breach affected approximately 1.2 million accounts after an attacker used stolen credentials belonging to a government official. Managed by the Directorate General of Public Finances, FICOBA contains highly sensitive data, including IBAN numbers, account holder identities, and addresses. The attacker accessed the system through legitimate channels, allowing queries to be made without raising immediate alerts. Authorities detected the intrusion in late January 2026 and moved quickly to restrict access and limit further data extraction.

ANTS Data Breach Reflects Broader Challenges in Data Protection

The ANTS data breach adds to a growing list of incidents affecting public sector systems in France. While the breach appears limited in terms of direct impact, it highlights ongoing challenges in managing personal data securely. Across recent cases, a consistent pattern is emerging. Attackers are not relying solely on traditional exploits. Instead, they are leveraging identity compromise, timing vulnerabilities, and gaps in monitoring to gain access to sensitive systems. French authorities have responded with notifications, investigations, and enhanced safeguards. However, these incidents reinforce the need for stronger controls around identity management, access monitoring, and data minimization. As investigations into the ANTS data breach continue, the findings are likely to shape how public sector platforms in France approach both security and user data protection going forward.