French Government Messaging Service Tchap Breached via Hijacked Account
Tchap, the French government's encrypted messaging platform, suffered a data breach after a user account was compromised through social engineering. Attackers reportedly scraped 13.5GB of data, including 560,000 messages and information on over 73,000 accounts, such as email addresses, organization details, meeting links, and account and device metadata, from the French tax authority and other civil servants. DINUM, the digital affairs directorate of the French government, issued a warning about the incident. The breach was disclosed on June 12, 2026.
Signal context
First seen: Jun 12, 2026
Last updated: Jun 30, 2026
Status: Public signal
Key points
- Social engineering attack led to a hijacked user account.
- 13.5GB of data scraped from the platform.
- Affected data includes 560,000 messages and information on over 73,000 accounts.
Signal analysis
BetaThis analysis groups the signal by industry, likely incident action and impacted security area. It helps compare this signal with other published signals without treating the labels as final determinations.
Sector: Information
Likely country: 🇫🇷 France
inferred from company domain
Watch phishing, executive impersonation and account-takeover exposure.
- Source type: outside the affected organization
Impact area: Confidentiality
Likely asset: User or customer data
- 25 signals in the same sector
- 88 signals with the same likely impact area
- 1 signal linked to this organization/domain
External sources
French Government Messaging Platform Breached by Mysterious 'Misere' Hacker - SecurityWeekhttps://www.securityweek.com/french-government-messaging-platform-breached-by-mysterious-misere-hacker/Public source from securityweek.com.
France's Tchap Breach Exposed 73,000 Civil Servants - Gblockhttps://gblock.com/frances-tchap-breach-exposed-73000-civil-servants/Public source from gblock.com.
Cyber News Roundup – June 12th 2026 - Integrity360https://www.integrity360.com/cyber-news-roundup-june-12th-2026Public source from integrity360.com.
Data Breach Roundup (June 5 - 11, 2026) - Privacy Guideshttps://www.privacyguides.org/news/2026/06/12/data-breach-roundup-june-5-11-2026/Public source from privacyguides.org.
La messagerie de l'État Tchap victime d'une fuite de données - Banque des Territoireshttps://www.banquedesterritoires.fr/la-messagerie-de-letat-tchap-victime-dune-fuite-de-donneesPublic source from banquedesterritoires.fr.
French govt messaging service breached in account hijacking attack - Bleeping Computerhttps://www.bleepingcomputer.com/news/security/french-govt-messaging-service-breached-in-account-hijacking-attack/Public source from bleepingcomputer.com.
Cyberattaque : Tchap, la messagerie des agents de l'État a été victime d'une fuite de données massive - Capitalhttps://www.capital.fr/economie-politique/cyberattaque-tchap-la-messagerie-des-agents-de-l-etat-a-ete-victime-d-une-fuite-de-donnees-massive-1527426Public source from capital.fr.
Related signals
Grouped by why the signal is relevant.
French government messaging platform Tchap breached via compromised user account
DINUM, the French government's digital affairs directorate, warned that hackers breached Tchap, France's encrypted messaging platform for public sector workers, using a compromised user account. The incident was detected by ANSSI, after which the affected account was blocked and an investigation launched into what conversations and data may have been accessed. DINUM has notified France's data protection authority, CNIL, due to the potential exposure of personal data. A threat actor claimed responsibility, alleging they used social engineering to access an education-related account and scrape messages, account information, and files, including 13.5GB of data from the French tax authority and other civil servants.
Malicious 'Edgecution' Extension Exploits Microsoft Edge Native Messaging for Ransomware Deployment
Security researchers reported on June 25, 2026, the discovery of a new malware campaign dubbed 'Edgecution,' which utilizes a malicious Microsoft Edge extension to deploy ransomware and a Python-based backdoor. The extension abuses the Native Messaging API to escape the browser sandbox and establish a persistent system-level executor. Attackers are reportedly using Microsoft Teams for social engineering, directing victims to fake 'Outlook Updates Management Console' websites to trick them into installing the malicious extension. This campaign is believed to be operated by an Initial Access Broker (IAB) linked to the 'Payout Kings' ransomware operation.
BIGLOBE Inc. Affected by KDDI Corporation Data Breach
BIGLOBE Inc., a Japanese internet service provider, was impacted by a data breach originating from an email system provided by KDDI Corporation. Threat actors gained unauthorized access to this shared system by exploiting a vulnerability in third-party software. This led to the potential exposure of up to 14.2 million email addresses and passwords across all affected ISPs. BIGLOBE Inc. customers' email addresses and passwords may have been compromised.
eogb.co.uk Hit by Stormous Ransomware Group
eogb.co.uk, a UK-based organization, was claimed as a victim by the Stormous ransomware group. The incident was discovered on June 28, 2026, at 21:29 UTC, with deep access to Microsoft Dynamics GP, internal legal documents, partnership agreements, customer contracts, operational spreadsheets, financial reports, and executive documents.
KDDI Web Communications Customer Data Affected by KDDI Email System Breach
KDDI Web Communications, a subsidiary of KDDI, was impacted by the data breach in KDDI Corporation's email system, disclosed on June 28, 2026. The incident, caused by a third-party software vulnerability, led to the potential exposure of up to 14.2 million email addresses and passwords belonging to customers across six Japanese ISPs, including KDDI Web Communications.
NIFTY Corporation Affected by KDDI Corporation Data Breach
NIFTY Corporation, a Japanese internet service provider, was impacted by a data breach originating from an email system provided by KDDI Corporation. Threat actors gained unauthorized access to this shared system by exploiting a vulnerability in third-party software. This led to the potential exposure of up to 14.2 million email addresses and passwords across all affected ISPs. NIFTY Corporation customers' email addresses and passwords may have been compromised.