ANSSI targeted by a cyberattack exploiting a Metabase software vulnerability also affecting Dinum
The National Cybersecurity Agency of France (ANSSI) reported a data breach affecting its own innovation laboratory as well as two instances of the Interministerial Directorate for Digital Affairs (Dinum).
The attack, which occurred on August 6, 2026, exploited a vulnerability in the Metabase software. Within ANSSI, 118 user accounts of the innovation laboratory were compromised, exposing identifiers, email addresses, usage statistics, and passwords transformed into unreadable characters. For Dinum, two instances related to the ProConnect and Nuage-Public services were affected, resulting in the leak of administrative information (SIREN and SIRET numbers), project metadata, and anonymized connection histories, described as already public. In response, both entities updated their systems, renewed passwords, and disabled or deleted the affected accounts.
Furthermore, the Prime Minister requested ANSSI to create an emergency response team, the "Interministerial Response & Action to Data Breaches" (REACTIV), considering that "few ministries meet the required level" in cybersecurity. The first report of this mechanism indicates 99 presumed data leaks in State services since August 1, 2026, of which 67 have been confirmed.
The attack, which occurred on August 6, 2026, exploited a vulnerability in the Metabase software. Within ANSSI, 118 user accounts of the innovation laboratory were compromised, exposing identifiers, email addresses, usage statistics, and passwords transformed into unreadable characters. For Dinum, two instances related to the ProConnect and Nuage-Public services were affected, resulting in the leak of administrative information (SIREN and SIRET numbers), project metadata, and anonymized connection histories, described as already public. In response, both entities updated their systems, renewed passwords, and disabled or deleted the affected accounts.
Furthermore, the Prime Minister requested ANSSI to create an emergency response team, the "Interministerial Response & Action to Data Breaches" (REACTIV), considering that "few ministries meet the required level" in cybersecurity. The first report of this mechanism indicates 99 presumed data leaks in State services since August 1, 2026, of which 67 have been confirmed.
Informations complémentaires
L’analyse complète est réservée aux membres
Montant de la sanction, thèmes, secteurs, entités et données concernées : l’essai gratuit de 14 jours ouvre la fiche entière et la veille personnalisée.
Essayer gratuitement 14 jours · accès complet · sans carte bancaire