On 12 November 2026, ANSSI, France’s national cybersecurity agency, published the second progress report of Operation REACTIV, which deals with data breaches in government services: 64 new breaches have been reported to it since 30 September, five of which concern ministries or bodies under their supervision, including the CAF (family allowance fund) and France Travail (the public employment service). Rather than sophisticated techniques, the document describes doors left ajar (stolen credentials, two-factor authentication that is missing or too weak, flaws allowing direct access to records) that are found in many businesses too.
What the second REACTIV report contains
Launched on 1 September at the request of the Prime Minister, Operation REACTIV allows the agency to impose emergency measures on ministries within tight deadlines and to centralise technical communication in the event of a crisis. The first report, published on 30 September, listed 99 breaches brought to the agency’s attention since 1 August, 67 of them confirmed.
The new CERT-FR update reports a significant decrease in breaches detected or claimed within the ministerial scope. No new weakness has emerged: the five categories already listed in September are enough to explain everything, namely weak or missing authentication, subcontracting, accounts stolen by credential-stealing programs (infostealers), so-called IDOR flaws, and development or configuration errors. ANSSI notes clear progress on two-factor authentication and puts at 70%, across government, the progress towards the 2026 objectives set by the State’s 2026-2027 digital security roadmap. It warns that its figures may still change and do not provide an exhaustive picture.
Five new incidents, the same flaws
- CAF: the VACAF holiday assistance platform had its data harvested by an automated process from 8 to 10 October, using partner account credentials stolen by an infostealer, without two-factor authentication, and a web address that exposed case numbers. ANSSI speaks of nearly 1.2 million records, with names, reference numbers, family quotient and identities of minors, but no bank details or passwords. IT-Connect notes that the Cnaf (the national family allowance fund) put forward, in a press release dated 2 November, a figure of 1,619,893 beneficiaries. Bringing the platform back online is conditional on a penetration test and the addition of two-factor authentication.
- France Travail: on 26 September, an employee’s account was compromised even though the second factor by SMS had indeed been validated, which allowed data to be extracted; on 8 October, someone claimed on a cybercrime forum to be selling data on more than 60,000 employees and professionals.
- French Biodiversity Office (OFB): on 4 October, candidates for the hunting licence exam were affected; an IDOR flaw in the payment interface of the registration portal exposed more than a thousand people, including minors, whose data was made freely accessible the same day.
- Agence de services et de paiement (ASP, the State’s services and payment agency): its DEFI portal, which pays trainees, was compromised on 30 September via a hijacked account and a vulnerability; the exfiltration concerns 30,500 users, who have been notified.
- Ministry for Europe and Foreign Affairs (MEAE): detected on 20 October, an intrusion into the libraries portal reportedly allowed a third party to view the personal data of around a hundred users, by means of technical accounts previously stolen from a compromised server.
Conversely, the Ministry of Agriculture illustrates the effect of good protection: compromised VPN certificates were detected, but two-factor authentication prevented the attacker from logging in.
The common thread: stolen secrets reused
For ANSSI, the investigations point to the same scenario: the attacker reuses stolen credentials, passwords or tokens to get into an application and extract its data just as a legitimate user would.
The recommended response is accordingly very concrete: first renew all compromised or suspect secrets, roll out strong authentication across the board, strictly control privileged accounts, tighten access filtering to prevent exfiltration and strengthen the security of applications exposed to the internet or to third-party networks. The agency also refers to a lessons-learned report on application data breaches published on 20 October. Finally, the France Travail case shows the limits of codes received by SMS: IT-Connect advises preferring FIDO2 security keys or passkeys, which are more resistant to phishing.
What a business can apply right now
The mechanisms described apply well beyond the State; several measures follow directly from the report:
- require two-factor authentication for partner and contractor accounts, often overlooked even though they opened the door to VACAF;
- gradually replace SMS with phishing-resistant factors for sensitive access;
- treat any machine infected by an infostealer as a credential leak and renew the secrets concerned, rather than just cleaning the machine;
- have your application programming interfaces tested against direct access to other users’ records before going live;
- monitor and cap the volumes extracted: the Ministry of Education, also cited in the report, is strengthening the supervision of its data flows and limiting their number.
Frequently asked questions
What is ANSSI’s Operation REACTIV?
It is a scheme that the Prime Minister asked ANSSI to set up on 1 September 2026 to respond to data breaches in government services. It gives ANSSI the power to enforce emergency measures on ministries and to coordinate technical communication in the event of an attack.
What is an IDOR flaw?
It is an access control flaw: once logged in, a user can reach other people’s data simply by changing an identifier in an address or a request. This type of flaw enabled the extraction of the VACAF records and the exposure of the hunting licence candidates.
Should affected CAF beneficiaries change their password?
According to ANSSI, no passwords or bank details are included in the extracted VACAF records. The identity and family situation data exposed may, however, be used for targeted scams: it is best to be wary of messages that cite such data to demand a payment or credentials.
Sources
- Point de situation de l'opération REACTIV – octobre 2026 (CERTFR-2026-CTI-010) — CERT-FR / ANSSI, 2026-11-12
- CAF, France Travail, OFB… l'ANSSI fait le point sur les fuites de données d'octobre 2026 — IT-Connect, 2026-11-12
- Point de situation de l'opération REACTIV – septembre 2026 (CERTFR-2026-CTI-006) — CERT-FR / ANSSI, 2026-09-30