French Government Messaging Platform Tchap Breached via Hijacked Account
Summary
DINUM says an attacker accessed France’s Tchap messaging platform through a compromised account, which was blocked. The attacker claims data theft, while officials investigate what conversations and data were accessed.
Key points
- DINUM said ANSSI detected unauthorized access to Tchap through a compromised user account; the account was immediately blocked.
- The attacker allegedly used social engineering and claims to have stolen more than 13.5 GB of files, nearly 650,000 messages, and information on over 73,000 accounts; these claims are unconfirmed.
- DINUM is reviewing event logs to determine which conversations and data the attacker could access and what data may have been exfiltrated.
- The attacker also claims to have obtained hardcoded LDAP credentials allegedly exposed in a PowerShell script shared by a regional director of a French tax authority.
- DINUM alerted France’s data protection authority, CNIL, over potential exposure of personal data.
- Users were reminded that public Tchap rooms are accessible to any user, are not encrypted, and should not be used for sensitive information.
Article Details
- Victim Organization
- French government (DINUM)
- Victim Domain
- tchap.gouv.fr
- Incident Type
- Unauthorized access to Tchap through a compromised user account; the attacker allegedly used social engineering.
- Data Types Exposed
- Messages
- Documents and media files
- Account information and metadata
- Email addresses
- Organization information
- Meeting links
- Affected Records
- The attacker claimed to have scraped nearly 650,000 messages and information on over 73,000 accounts; these figures have not been confirmed.
- Affected Data Size
- The attacker claimed to have stolen over 13.5 GB of documents and media files; this has not been confirmed.
- Operational Impact
- ANSSI detected the breach. The account associated with the malicious requests was blocked, and DINUM is investigating which conversations and data the attacker could access.
- Claim Status
- confirmed