France's FICOBA bank register breached using stolen official credentials
An attacker used a civil servant's credentials to access details of about 1.2 million French bank accounts. Names, addresses and IBANs were exposed, but not balances or transactions. Watch for convincing bank or tax scams and check statements.
If DGFiP notified you, tell your bank and check transactions at least weekly, reporting anything unfamiliar immediately. Verify unexpected bank or tax contacts using independently obtained contact details; never share passwords or approve payments at a caller's request. DGFiP says you do not need to change bank accounts because of this breach.
What’s happening
An attacker used a civil servant's credentials to access France's FICOBA bank-account register between 28 January and 13 February 2026. The finance ministry estimated that information concerning approximately 1.2 million accounts was affected, including account-holder identities, addresses and bank details such as IBANs. This is an account count, not a confirmed number of people. FICOBA did not expose balances, transactions or banking passwords. BleepingComputer reported possible exposure of tax identifiers, but the ministry's current statement explicitly says they were not accessed. Access restrictions stopped the intrusion; authorities alerted banks, notified CNIL, filed a criminal complaint and began individual notifications. The March update still described service restoration and security work as ongoing. An August parliamentary inquiry proposal cited the incident. Sources reviewed through 3 November do not establish completed restoration or notification, arrests linked to this breach, or confirmed subsequent fraud using the data. No device update is required.
- What
- Breach
- Affects
- France's FICOBA national bank-account register
- Fixed in
- Nothing to patch
- Since
- 18 Feb 2026
- Closed
- 27 Aug 2026
Timeline
- Update
French MPs filed a proposal for a parliamentary inquiry into public-sector data breaches, citing FICOBA and its approximately 1.2 million affected accounts. The proposal called for scrutiny of authentication, access permissions and detection of abnormal access.
- Update
The ministry confirmed that access restrictions had stopped the intrusion. Its update still described security improvements and service restoration as ongoing, with some individual notifications still to follow.
- Update
DGFiP's FAQ said affected people had received or would shortly receive an email or letter. It confirmed that banking passwords, balances and transactions were not exposed and said customers did not need to change bank accounts.
- Made publicNothing to patch
The finance ministry disclosed that an attacker had used a civil servant's credentials to access and extract information concerning approximately 1.2 million bank accounts. Access was restricted, banks and CNIL were informed, and a criminal complaint was filed.
- Update
Unauthorised consultations of FICOBA began. DGFiP's subsequent FAQ dates the activity from 28 January to 13 February 2026.
Sources
- Accès illégitimes au fichier national des comptes bancaires (FICOBA)French Ministry of Finance · 18 Feb 2026
- Foire aux questions : accès illégitimes au fichier national des comptes bancaires FICOBADGFiP · 27 Feb 2026
- FICOBA : tout savoir à l'accès illégitime au fichier national des comptes bancairesFrench Ministry of Finance · 3 Mar 2026
- Attackers breach France's national bank account databaseThe Record · 19 Feb 2026
- Data breach at French bank registry impacts 1.2 million accountsBleepingComputer · 20 Feb 2026
- Proposal for a parliamentary inquiry into cybersecurity failures affecting public-sector data, No. 3112French National Assembly · 27 Aug 2026