{"id":"france-ficoba-bank-register-breach-feb-2026","category":"breach","status":"closed","title":"France's FICOBA bank register breached using stolen official credentials","tldr":"An attacker used a civil servant's credentials to access details of about 1.2 million French bank accounts. Names, addresses and IBANs were exposed, but not balances or transactions. Watch for convincing bank or tax scams and check statements.","summary":"An attacker used a civil servant's credentials to access France's FICOBA bank-account register between 28 January and 13 February 2026. The finance ministry estimated that information concerning approximately 1.2 million accounts was affected, including account-holder identities, addresses and bank details such as IBANs. This is an account count, not a confirmed number of people. FICOBA did not expose balances, transactions or banking passwords. BleepingComputer reported possible exposure of tax identifiers, but the ministry's current statement explicitly says they were not accessed. Access restrictions stopped the intrusion; authorities alerted banks, notified CNIL, filed a criminal complaint and began individual notifications. The March update still described service restoration and security work as ongoing. An August parliamentary inquiry proposal cited the incident. Sources reviewed through 3 November do not establish completed restoration or notification, arrests linked to this breach, or confirmed subsequent fraud using the data. No device update is required.","action":"If DGFiP notified you, tell your bank and check transactions at least weekly, reporting anything unfamiliar immediately. Verify unexpected bank or tax contacts using independently obtained contact details; never share passwords or approve payments at a caller's request. DGFiP says you do not need to change bank accounts because of this breach.","product":"France's FICOBA national bank-account register","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["france","ficoba","dgfip","data-breach","banking","stolen-credentials"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Accès illégitimes au fichier national des comptes bancaires (FICOBA)","url":"https://presse.economie.gouv.fr/acces-illegitimes-au-fichier-national-des-comptes-bancaires-ficoba/","by":"French Ministry of Finance","date":"2026-02-18"},{"kind":"advisory","title":"Foire aux questions : accès illégitimes au fichier national des comptes bancaires FICOBA","url":"https://www.impots.gouv.fr/sites/default/files/media/2_actu/home/2026/faq_ficoba.pdf","by":"DGFiP","date":"2026-02-27"},{"kind":"advisory","title":"FICOBA : tout savoir à l'accès illégitime au fichier national des comptes bancaires","url":"https://www.economie.gouv.fr/actualites/ficoba-tout-savoir-lacces-illegitime-au-fichier-national-des-comptes-bancaires","by":"French Ministry of Finance","date":"2026-03-03"},{"kind":"news","title":"Attackers breach France's national bank account database","url":"https://therecord.media/attackers-breach-france-national-bank-account-database","by":"The Record","date":"2026-02-19"},{"kind":"news","title":"Data breach at French bank registry impacts 1.2 million accounts","url":"https://www.bleepingcomputer.com/news/security/data-breach-at-french-bank-registry-impacts-12-million-accounts/","by":"BleepingComputer","date":"2026-02-20"},{"kind":"post","title":"Proposal for a parliamentary inquiry into cybersecurity failures affecting public-sector data, No. 3112","url":"https://www.assemblee-nationale.fr/dyn/docs/PNREANR5L17B3112.raw","by":"French National Assembly","date":"2026-08-27"}],"started":"2026-02-18","closed":"2026-08-27","created":"2026-11-03T21:08:40.639Z","updated":"2026-11-03T21:08:40.639Z","cve_notes":[],"timeline":[{"at":"2026-08-27","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"French MPs filed a proposal for a parliamentary inquiry into public-sector data breaches, citing FICOBA and its approximately 1.2 million affected accounts. The proposal called for scrutiny of authentication, access permissions and detection of abnormal access.","url":"https://www.assemblee-nationale.fr/dyn/docs/PNREANR5L17B3112.raw","by":"French National Assembly","patch":null},{"at":"2026-03-03","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"The ministry confirmed that access restrictions had stopped the intrusion. Its update still described security improvements and service restoration as ongoing, with some individual notifications still to follow.","url":"https://www.economie.gouv.fr/actualites/ficoba-tout-savoir-lacces-illegitime-au-fichier-national-des-comptes-bancaires","by":"French Ministry of Finance","patch":null},{"at":"2026-02-27","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"DGFiP's FAQ said affected people had received or would shortly receive an email or letter. It confirmed that banking passwords, balances and transactions were not exposed and said customers did not need to change bank accounts.","url":"https://www.impots.gouv.fr/sites/default/files/media/2_actu/home/2026/faq_ficoba.pdf","by":"DGFiP","patch":null},{"at":"2026-02-18","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"The finance ministry disclosed that an attacker had used a civil servant's credentials to access and extract information concerning approximately 1.2 million bank accounts. Access was restricted, banks and CNIL were informed, and a criminal complaint was filed.","url":"https://presse.economie.gouv.fr/acces-illegitimes-au-fichier-national-des-comptes-bancaires-ficoba/","by":"French Ministry of Finance","patch":"na"},{"at":"2026-01-28","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Unauthorised consultations of FICOBA began. DGFiP's subsequent FAQ dates the activity from 28 January to 13 February 2026.","url":"https://www.impots.gouv.fr/sites/default/files/media/2_actu/home/2026/faq_ficoba.pdf","by":"DGFiP","patch":null}],"url":"https://hard.fyi/live/france-ficoba-bank-register-breach-feb-2026/","json":"https://hard.fyi/api/live?id=france-ficoba-bank-register-breach-feb-2026"}