Cyber Incident Victim: Ministry of Economy
Date:
Jan 2026
Location:
France
Summary
France's Ministry ofEconomy disclosed that unauthorized access to the national bank account registry FICOBA exposed information on 1.2 million bank accounts, including IBANs, holder names, addresses and, in some cases, tax identifiers. Investigators said a threat actor stole an official’s credentials and used them to enter the database, after which the access was cut off and affected individuals are being notified. Officials noted the attacker could not perform banking operations or view balances but warned of possible scams and phishing attempts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
France’s Ministryof Economy disclosed on Wednesday that a breach had exposed information on 1.2 million bank accounts. Investigators determined that unauthorized access had been gained to the national bank account registry known as FICOBA. The intrusion began when a threat actor stole credentials belonging to an official within the ministry. Those stolen credentials were then used to log into the database that stores details on every bank account opened in France.
The breach took place in late January and affected approximately 1.2 million accounts. The data that was accessed included International Bank Account Numbers (IBANs), the names of account holders, their postal addresses, and in certain instances tax identification numbers. Officials confirmed that the attacker did not obtain the ability to perform banking transactions or to view account balances. Despite this limitation, the exposed personal information could be leveraged for social engineering schemes.
Following the discovery, the ministry terminated the attacker’s access to the system. Affected individuals are being notified of the incident and advised to remain vigilant against potential scams and phishing attempts. The ministry has stated that it is working to secure the registry and prevent further unauthorized access. No further details about the attacker’s identity or motives have been released in the disclosed information.