Threat watch / Breach
French Foreign Ministry: library portal entered with stolen technical accounts
According to an ANSSI status report relayed by Fuites Infos and Cyberattaque.org, a cyberattack detected on October 20, 2026 hit the library portal of the French Ministry for Europe and Foreign Affairs. A third party reportedly accessed the personal data of about a hundred users of the portal, using technical accounts stolen beforehand from a compromised server. Attempts to escalate privileges were blocked. The ministry had published no communication by November 12.
- Sector
- Government & politics
- Way in
- Stolen credentials
- Product or vendor
- None named
- How it happened
- According to ANSSI, as relayed by both outlets, the attacker reached the production environments of the library portal using technical accounts stolen beforehand from a compromised server. Attempts to escalate privileges were blocked. How those accounts were first stolen is not public.[1][2][3] Checked 14 Nov 2026
- What was stolen
- A third party reportedly accessed personal data of about a hundred portal users. The data categories are not specified, and the report as relayed does not say whether the data was copied.[1][2][3] Checked 14 Nov 2026
- Who was impacted
- About a hundred users of the ministry's library portal: ministry agents, librarians and external users. It is not known whether they have been informed.[1][2][3] Checked 14 Nov 2026
- Threat actor
- Not attributed
Timeline
- A cyberattack on the library portal of the Ministry for Europe and Foreign Affairs is detected, according to ANSSI. [1][2]
- Fuites Infos and Cyberattaque.org report the incident from an ANSSI status report on attacks against State services. Fuites Infos notes the ministry has published no communication on it. [1][2]
- CERT-FR's own October REACTIV status report confirms the intrusion into the portal's production environments, the roughly hundred users (agents, librarians and external users), the stolen technical accounts and the blocked privilege escalation. It says the investigation continues with the provider and ANSSI's support. [3]