French authorities have confirmed that a hacker accessed sensitive data linked to 1.2 million bank accounts through the country’s national banking registry, raising fresh concerns about cybersecurity vulnerabilities within government systems.
In a statement released, the Ministry of the Economy and Finance said the attacker used stolen login credentials belonging to a government official to gain unauthorized access to the FICOBA database — France’s centralized file of bank accounts.
The database is administered by the Direction Générale des Impôts and contains records of all bank accounts held in France, totaling approximately 300 million accounts. The registry includes personal information such as bank account numbers, account holder names, addresses, and in some cases, tax identification numbers.
According to the ministry, the intrusion began in late January and involved the consultation of “parts of the file” covering 1.2 million accounts. Officials said that once the unauthorized access was detected, immediate measures were taken to block the attacker and prevent any removal of data.
The ministry emphasized that the breach was limited to data access rather than system alteration and that protective actions were swiftly implemented. An investigation is ongoing to determine the full scope of the incident and whether additional safeguards are required.
Cybersecurity experts note that even without confirmed data exfiltration, exposure to sensitive financial and personal information can increase the risk of phishing campaigns, identity theft, and financial fraud. Attackers often leverage partial data to craft convincing scams targeting affected individuals.
The incident underscores the growing threat of credential-based attacks against public institutions, where hackers exploit legitimate access rights rather than breaching systems through technical vulnerabilities. As investigations continue, the breach is likely to intensify scrutiny of cybersecurity protocols within France’s public administration.
