www.it-connect.fr
CAF, France Travail, OFB: ANSSI Reviews October 2026 Data Breaches
64 new data breaches reported in one month, including 5 in ministries or public bodies under their oversight: ANSSI has just published the second situation update on Operation REACTIV. CAF, France Travail, OFB... and the same old weaknesses. Here’s what you need to know.
As a reminder, Operation REACTIV ("REponse & ACTion Interministérielle face aux Violations de données") was launched on September 1, 2026 at the request of the Prime Minister. As I explained in this article on the launch of REACTIV and ANSSI's new powers over ministries, the agency can now impose emergency measures on ministries within tight deadlines.
The first situation report, published on September 30, listed 99 data breaches reported since August 1, 2026, including 67 confirmed incidents. That document revealed that ANSSI's innovation lab and two DINUM instances had been compromised through a Metabase flaw. On November 12, 2026, CERT-FR published the second situation report on Operation REACTIV, covering October 2026.
More leaks in ministries, and the same flaws again
Since September 30, 2026, brace yourself: 64 new data breaches have been brought to ANSSI's attention. Only 5 involve ministries or public bodies under their oversight, and the French agency notes "a significant decrease" in the number of breaches detected or claimed in this scope. That’s a good thing.
But the root causes are still the same... Indeed, the incidents that occurred in October 2026 did not reveal any additional weaknesses compared with those listed in September:
- Lack of multi-factor authentication (MFA) or weak authentication (a single password)
- Outsourcing and supply chain issues (a breached service provider with access to the system)
- Accounts compromised by infostealers (malware that steals credentials stored on a device, for example a personal PC used for work)
- IDOR vulnerabilities (changing a case number in the URL to view someone else’s records)
- Development and configuration flaws (an API returning more data than necessary, an administration interface exposed to the Internet, and so on!)
This leads to the recurring pattern of reusing stolen secrets (usernames, passwords, tokens) to log into applications, then extracting data through what appear to be legitimate access paths. Still, there is a positive note: ANSSI does mention significant progress, especially on MFA, and the overall progress toward the 2026 goals in the State's digital security roadmap has reached 70%.
CAF, France Travail, OFB: the five new incidents
That said, ANSSI reported these 5 new incidents:
- CAF (VACAF): between October 8 and 10, the data from vacaf.org, the CAF holiday assistance platform, was automatically extracted using partner accounts stolen by infostealers (without MFA) and a URL exposing case identifiers (IDOR). ANSSI mentions nearly 1.2 million records, while Cnaf stated in its November 2 press release that 1,619,893 beneficiaries were affected. Among the data exposed: registration numbers, family quotient, and children's identities were part of the leak, but no banking data or passwords.
- France Travail: on September 26, data was exfiltrated through the compromised account of an agent, with the second factor (SMS) having been validated. The sale of data belonging to more than 60,000 agents and professionals was claimed on October 8.
- French Office for Biodiversity: on October 4, an IDOR flaw in the payment API of the registration portal for the hunting license exam exposed the data of more than 1,000 people, including minors, and it was published the same day. "After the vulnerabilities were fixed, the site was able to be put back online during October," ANSSI states.
- Payment Services Agency: the DEFI portal (intern stipend payments) was compromised on September 30, and the data of 30,500 users, who have since been notified, was exfiltrated.
- Ministry for Europe and Foreign Affairs: an intrusion was detected on October 20 on the libraries portal. A third party allegedly used stolen technical accounts to access the data of around one hundred users.
As was the case in previous incidents, some cases still involve very basic flaws. VACAF is one example, with an exploited IDOR vulnerability (an access control flaw): the application does not check whether the logged-in user is authorized to view the requested object. All it takes is modifying an identifier, such as a case number in the URL, to access someone else’s data.
In the case of France Travail, the report does not specify how the second authentication factor, namely the SMS code, was validated. This is a good reminder that SMS codes are not a phishing-resistant factor; a FIDO2 security key or a passkey is a better choice.
What do you think?
