The French Interior Ministry recently acknowledged that hackers successfully infiltrated the CHEOPS portal, a centralized system used to manage classified police records and criminal processing data. This breach, described by Interior Minister Laurent Nuñez as unprecedented, allowed unauthorized access to the system for several weeks before the intrusion was detected. The affected files reportedly contain information on approximately 16.4 million people, and there are concerns that the personal contact details and email accounts of police investigators may have been compromised during the incident.
Investigations into the cause of the breach suggest that the security failure was facilitated by poor digital hygiene among certain staff members. Minister Nuñez pointed to the imprudent sharing of passwords and sensitive credentials through external messaging applications, which provided the entry point for the attackers. Although the ministry took steps to enhance server security once suspicious activity was identified, the measures were implemented only after the system had already been compromised. This incident follows a series of recent cyberattacks targeting various French public institutions and social service bodies.
GET 50% Discount for VPN/ANTIVIRUS SOFTWARE AT 911Cyber - CODE: bit5025
A hacking collective known as BreachForums claimed responsibility for the infiltration, initially issuing an ultimatum to the ministry. When their undisclosed demands were not met within a forty-eight-hour window, the hackers followed through on their threat by making the stolen data available for purchase on the dark web. The group framed the leak as a retaliatory act, posting a message suggesting the attack was a response to previous actions taken against their associates.
Law enforcement has already made progress in the criminal investigation, leading to the arrest of a twenty-two-year-old man in Limoges. The suspect, who was already known to authorities for similar cyber-related offenses committed in 2025, remains in custody as investigators determine his specific role in the breach. Despite the scale of the data accessed, the Interior Ministry clarified that administrative files related to passports and residency permits do not appear to have been affected by this specific attack.
The National Commission for Information Technology and Civil Liberties has been formally notified of the situation, as required by law for significant data breaches. Moving forward, the government is focusing on strengthening internal protocols to prevent similar lapses in password security and data handling. While the immediate focus is on the legal proceedings against the arrested individual, the breach has sparked a wider conversation regarding the vulnerability of sensitive state infrastructure to modern cyber threats.
Source: Hackers Access Classified Information From French Police Systems
Solid breakdown of the CHEOPS breach. The part that stuck out is how passwords got shared through external messaging apps, which basically gave attackers the keys. I've seen this same patttern in enterprise environments where convenience wins over protocol until something like this happens. The delayed detction window of several weeks shows why monitoring and anomoly flagging needs to be agressive from day one, not reactive.