cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

French Government Says Tchap Breach Affected 73,467 Accounts

· Original article ↗

Summary

DINUM said an attacker used a compromised account to access Tchap public-chat data potentially affecting 73,467 users. Private conversations remained encrypted; broader claims of stolen messages and files are unconfirmed.

Key points

  • DINUM said an attacker gained access to Tchap using a compromised user account; the account was identified and blocked.
  • The government said 73,467 of more than 825,000 registered users may be affected.
  • The accessed public-chat data could include names, email addresses, avatars, and users’ public-sector organizations; private conversations remained encrypted.
  • The attacker claimed to have scraped nearly 650,000 messages and information from more than 73,000 accounts; these claims are not independently confirmed in the article.
  • The attacker also claimed to have stolen more than 13.5 GB of documents and media, and to have exposed hardcoded LDAP credentials via a PowerShell script.
  • DINUM notified France’s data protection authority, CNIL, about the potential exposure of personal data.

Article Details

Victim Organization
French government (DINUM)
Incident Type
Breach involving access through a compromised user account to Tchap public chat rooms
Data Types Exposed
  • Names, email addresses, avatar images, and public-sector organization details were potentially exposed from public chat rooms, according to DINUM.
  • Messages, meeting links, account and device metadata, documents, and media files were allegedly accessed or stolen, according to the threat actor.
  • Hardcoded LDAP credentials were allegedly exposed via a PowerShell script, according to the threat actor.
Affected Records
73,467 accounts were reported by DINUM as potentially affected; the threat actor claimed information from more than 73,000 accounts.
Affected Data Size
The threat actor alleged that over 13.5 GB of documents and media files were stolen; this volume was not confirmed by DINUM.
Operational Impact
The compromised account was blocked to remove persistent access and enable further analysis. DINUM said private conversations remained protected by encryption, while data in public chat rooms was accessed.
Ransom Or Extortion
No ransom demand or extortion activity was reported.
Claim Status
confirmed

MITRE ATT&CK

T1078 · Valid AccountsA compromised user account was used to access Tchap, as reported by DINUM.

Products

TchapThe French government said a breach of the Tchap encrypted messaging platform affected accounts tied to more than 73,000 public sector employees after an attacker used a compromised account.

Countries

Francethat a threat actor gained access to the Tchap platform using a compromised user account and notified France’s data protection authority (CNIL) due to the potential exposure of personal data shared by some users.

Industries

Public SectorThe French government said a breach of the Tchap encrypted messaging platform affected accounts tied to more than 73,000 public sector employees after an attacker used a compromised account.