ANSSI's first REACTIV situation report: 99 data breaches reported against French state services since 1 August, driven by Metabase CVE-2026-72898, infostealer credentials without MFA, IDOR flaws and supplier rebound

ANSSI published the first situation report of its REACTIV operation on 2026-09-30, set up after the Prime Minister asked on 2026-09-01 for a reinforced response capability for state services, including the power to have ministries take urgent measures within tight deadlines (ANSSI, 2026-09-30). Since 2026-08-01, 99 data breaches have been reported to ANSSI, 67 of them confirmed and 32 of those still being handled by the agency, and the report says its figures are provisional (ANSSI, 2026-09-30). It names the recurring causes: mass exploitation of the Metabase SQL injection CVE-2026-72898 since early August, with nine ministry instances compromised and a fix available since 2026-08-06; credentials stolen by infostealers on personal devices used for work, or taken from earlier breaches, that opened exposed services without a second factor; IDOR flaws, sometimes combined with other weaknesses, that allowed mass document exfiltration; missing or weak MFA, an email second factor counting as weak; compromise by rebound through a supplier that held ministry data; and, less often, missing authorization checks, SQL injection and exposed files (ANSSI, 2026-09-30). ANSSI asked all ministries to inventory their Metabase instances and verify they are updated (ANSSI, 2026-09-30).

The report's incident summaries show the shape of the losses: a compromised Tchap account of an Education nationale agent was used to read public and private rooms it already had access to and the conversations were exfiltrated; a claimed IDOR data leak on a Service national universel portal would expose 275,000 users and is still under investigation; and the compromise of the subcontractor of the operator of a TRACFIN reporting portal's support module led to exfiltration of the contact data of 136 reporting entities and the content of 213 support requests, after which the administration ended its relationship with that supplier (ANSSI, 2026-09-30).

Exposure: internet-facing public-sector services where staff or supplier accounts sign in with a password only or an email second factor, portals whose object identifiers are not checked against the caller's authorization, suppliers that hold your data, and any Metabase instance not upgraded since 2026-08-06 (ANSSI, 2026-09-30).