Hackers Breach French Government Messaging Platform Tchap

PARIS — Hackers breached the French government's encrypted messaging platform Tchap on Tuesday, gaining access to over 73,000 user accounts and exfiltrating 13.5 gigabytes of documents and media files. The intrusion was achieved through a social engineering attack that allowed threat actors to hijack a single user account, according to officials who disclosed the incident.

The breach of Tchap, a secure communication tool widely used by French civil servants and public sector employees, represents a significant security failure for the nation's digital infrastructure. The attackers exploited human vulnerability rather than technical flaws in the encryption system itself, manipulating a user into surrendering credentials or bypassing security protocols. Once inside the network, the threat actors moved laterally, compromising a vast number of accounts and downloading sensitive data.

French authorities confirmed the scope of the data theft, which includes 13.5GB of information. The nature of the exfiltrated content remains under investigation, though the volume suggests a mix of official correspondence, internal memos, and potentially classified media files. The incident has raised immediate concerns about the security of government communications and the potential for espionage or data manipulation.

The attack occurred on June 9, 2026, with the breach detected shortly after the initial compromise. Security teams immediately initiated a containment protocol, resetting credentials and locking down affected accounts to prevent further unauthorized access. The French National Cybersecurity Agency (ANSSI) is leading the investigation into the origin of the attack and the identity of the threat actors.

No specific group has claimed responsibility for the breach, and the motivation behind the attack remains unclear. While state-sponsored espionage is a possibility given the target, the use of social engineering suggests a method often employed by criminal syndicates or opportunistic hackers seeking to sell stolen data on the dark web. The lack of a public ransom demand or political statement has left the intent ambiguous.

Government officials have urged civil servants to remain vigilant and follow updated security protocols. Tchap has been temporarily restricted for certain high-risk departments while forensic teams analyze the extent of the damage. The incident has prompted a broader review of cybersecurity measures across French public institutions, highlighting the persistent risks posed by human error in digital security.

As the investigation continues, questions remain regarding the full extent of the compromised data and whether any sensitive information has already been leaked or sold. Authorities have not yet determined if the breach was part of a coordinated campaign targeting multiple government entities or an isolated incident. The outcome of the probe will likely influence future policies on secure communication within the French administration.