Threat watch / Breach
ASP (France): trainee pay portal breached, data of 30,500 users taken
CERT-FR's October REACTIV status report, published on November 12, 2026, says France's Agence de service et de paiement (ASP), the public body that pays certain State aid, suffered several data breaches with no identified link between them. Its PROFIL and PUMA portals were compromised in August 2026. On September 30, its DEFI portal, which pays trainees, was compromised through an impersonated account and a vulnerability; the attack was claimed on October 9 and data of 30,500 users was exfiltrated. The users have been notified.
- Sector
- Government & politics
- Way in
- Not public yet
- Product or vendor
- None named
- users of the DEFI trainee pay portal whose data was exfiltrated[1]
- 30,500
- How it happened
- According to CERT-FR, the DEFI portal was compromised on September 30, 2026 through an impersonated account and the exploitation of a vulnerability. It does not say which came first or what the vulnerability was. It does not say how the PROFIL and PUMA portals were compromised in August; the breaches have no identified link to each other.[1] Checked 14 Nov 2026
- What was stolen
- Personal data, exfiltrated from the PROFIL and PUMA portals and from the DEFI portal (30,500 users), according to CERT-FR. The report does not list which data fields were taken.[1] Checked 14 Nov 2026
- Who was impacted
- 30,500 users of the DEFI trainee pay portal, who were notified, plus users of the PROFIL and PUMA portals, whose number is not given. The ASP's supervising ministries are Agriculture and Labour and Solidarity.[1] Checked 14 Nov 2026
- Threat actor
- Not attributed
Timeline
- In August 2026, the ASP detects that its PROFIL and PUMA portals have been compromised, letting attackers exfiltrate personal data. Both are patched and reopened, according to CERT-FR. [1]
- The DEFI portal, which pays trainees, is compromised through an impersonated account and a vulnerability. [1]
- The attack on DEFI is claimed; the portal is isolated immediately. Data of 30,500 users was exfiltrated, and they are notified. [1]
- CERT-FR's October REACTIV status report describes the breaches. The ASP, its supervising ministries and ANSSI have started reviewing and securing its portals and improving monitoring and detection. [1]