Centre National de la Fonction Publique Territoriale

Summary

On July 4, 2025, a French public-sector organization was hit by a cyberattack targeting its online platform for external trainers and contributors. The intrusion resulted in unauthorized access to personal data belonging to individuals registered on the platform, primarily documents uploaded from 2022 onward along with earlier CVs, while pre-2022 non-CV records remained inaccessible. Following detection, the organization immediately shut down the affected platform, notified the relevant data protection and cybersecurity authorities, contacted registered users by email, and set up a dedicated contact channel to address inquiries. Security and remediation work continued over the following months, enabling a partial reopening of the platform in late September and full restoration thereafter.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 4, 2025, the Centre National de la Fonction Publique Territoriale (CNFPT), the French public institution responsible for the training of territorial civil servants, fell victim to a cyberattack. The attack specifically targeted the platform dedicated to external contributors and trainers, known as the "espace intervenants" (intervenant.cnfpt.fr). The CNFPT publicly identified the intrusion at the beginning of July and responded by immediately shutting down the affected platform. According to statements made by the institution to AEF info on July 9, 2025, the attackers succeeded in stealing certain documents belonging to contributors who had uploaded them to the platform starting from 2022. Documents deposited prior to 2022 were reportedly not accessible from the platform, except for CVs. Following the discovery of the breach, the CNFPT took steps to inform the impacted individuals and to engage relevant regulatory and cybersecurity authorities.

In the immediate aftermath of detecting the intrusion, the CNFPT deactivated the compromised platform, leaving it inaccessible as of July 9, 2025. The institution notified all registered contributors via email, informing them of the breach and providing guidance on how to proceed. In addition, a dedicated cell and a dedicated email inbox were established to handle inquiries from concerned contributors. The CNFPT also filed notifications with both the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority, and the Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI), the national cybersecurity agency. A formal investigation was launched to determine the exact nature of the personal data that had been illicitly accessed and exfiltrated by the threat actors.

Throughout the summer of 2025, the CNFPT carried out extensive security and remediation works aimed at reinforcing the platform's defenses before any reopening could be considered. These efforts culminated in a partial reopening of the contributor space on Monday, September 22, 2025. Following this partial restoration, the platform was eventually returned to full functionality, becoming accessible continuously, seven days a week and twenty-four hours a day. The institution maintained a frequently asked questions section on its official website to keep contributors updated on the evolving situation. This FAQ was originally created on July 8, 2025, and subsequently updated on December 9, 2025, to reflect the latest information available regarding the incident and the restored platform.

The scope of the data breach was centered on the personal information and professional documents of individuals registered as contributors on the CNFPT platform. Because the attackers exploited a vulnerability or unauthorized access vector targeting the platform, they were able to retrieve files uploaded since the year 2022. The exact technical method employed by the attackers, as well as the precise category of personal data compromised, remained under active investigation at the time of the institution's statements. The deliberate shutdown of the platform served both to halt the ongoing unauthorized access and to allow forensic teams to assess the full extent of the breach without risking further data loss. The incident underscored the vulnerability of public sector digital platforms to targeted cyber intrusions and the necessity of rapid containment measures. The coordinated response involving regulatory notification, public communication, and technical remediation reflected the standard protocol expected of a major public institution following a significant data breach.

Sources

Sources available to members: 2 sources.