France confirms cyberattack on Ministry of Interior as hackers claim data exposure of 16 million people

France’s Ministry of the Interior has confirmed a serious cyberattack on its information systems following hacker claims that data belonging to more than 16 million individuals was compromised. Authorities acknowledge unauthorized access but dispute the scale of the alleged data breach.

The attack was announced on the resurrected Breachforums hacking forum, where threat actors claimed they had breached systems operated by France’s Ministry of the Interior (Beauvau) and accessed sensitive government databases. According to the attackers, the breach allegedly exposed data on 16.4 million individuals, nearly a quarter of France’s population.

• The Ministry confirmed a “malicious intrusion,” stating that the incident is being handled at the highest level. Initial investigations suggest that attackers gained access to a limited number of professional email accounts, potentially retrieving credentials that enabled entry into internal applications.

• Interior Minister Laurent Nuñez confirmed that systems such as the Criminal Records Processing System (TAJ) and the Wanted Persons File (FPR) were among those accessed. However, he stressed that authorities have so far confirmed the removal of only a few dozen files, not millions of records as claimed by the attackers.

French authorities believe the attack stemmed from compromised credentials that were shared in plain text via internal email communications, in violation of security policies. This enabled attackers to access systems through the CHEOPS portal, used for inter-agency communication.

While hackers describe the intrusion as an act of revenge for the arrest of members of the ShinnyHunters / hollow cybercrime group, they simultaneously issued financial demands, threatening to sell the data if payment is not made. However, no substantial data samples have been released, raising doubts among security researchers about the true scale of the breach.

The cyberattack on France’s Ministry of the Interior highlights the persistent risks facing government institutions, particularly those related to human error and weak credential management. Regardless of the attackers’ claims, unauthorized access to systems containing criminal and personal data represents a serious national security concern.