France's Tchap government messenger — account-takeover scrapes 73,467 civil servants' metadata

The most consequential public-sector incident of the week. On 7 June ANSSI detected a compromise of Tchap, the French state's sovereign Matrix-based encrypted messenger used by ~825,000 civil servants across all ministries; DINUM published the disclosure (DINUM; daily 06-10). The attacker used account takeover to scrape directory metadata on 73,467 users; message content, protected by end-to-end encryption, was not exposed, and CNIL was notified. The defender takeaway is that "sovereign and E2E-encrypted" still leaves a metadata-harvesting surface at the account/identity layer — the directory is a target even when the message body is not.