Most data thefts need no technical flaw at all, says France's ANSSI

No sophisticated exploit, no unknown vulnerability: most often, reused credentials, social engineering or data left without access control were enough. That is the finding of CERT-FR, the incident response center of the ANSSI (France's national cybersecurity agency), in an 80-page lessons-learned report published on October 20 on data theft from web applications.

First, the numbers. In 2025, CERT-FR was notified of 196 data exfiltration incidents, compared with 130 handled in 2024. The document finds no particular targeting: any sector and any organization can be hit. Above all, "in most cases," these leaks result from intrusions that did not exploit any technical vulnerability. They involve the reuse of legitimate credentials, access obtained through social engineering or, quite simply, data exposed without access control.

A single stolen account can open the whole database

The anonymized cases cited by CERT-FR look alike. In May 2025, an e-health service lost part of its personal and medical data. The attacker had taken control of a user account, which gave access to an API (application programming interface) querying the database. In another case, an overly permissive API let a compromised account extract data its owner had no right to see.

Infostealers, the malware that harvests passwords and session cookies from workstations, come up again and again. In February 2025, several food industry companies were hit after employees installed a fake free Word-to-PDF converter. The tool stole the documents submitted to it and produced files that spread the infection. In late 2025, public services also suffered leaks because of infostealers on their users' personal computers. The service provider is the other weak point. One laboratory, for example, saw medical test results leak through the account of a subcontractor that managed the results-viewing application.

Finally, the report stresses how fast these thefts happen. The personal data of millions of people may weigh only a few gigabytes, which can be exfiltrated "in a handful of minutes." Yet assessing an alert can take a human team several hours, and attackers often act outside office hours.

The ten recommended measures

The central message fits in one sentence of the report: "In 2026, authentication with a login/password pair is obsolete." According to CERT-FR, any application that relies solely on this mechanism should be considered at high risk of being hacked. Its recommendations are grouped into ten categories:

1. apply a data management policy;
2. limit user access;
3. limit the application's exposure;
4. move beyond the username/password pair;
5. secure the hosting environment;
6. log user actions;
7. monitor logs to spot anomalies;
8. trigger automatic reactions and alerts in case of abnormal situations;
9. verify application security;
10. for government agencies, certify each application under the General Security Framework (RGS) and the State's information systems security policy (PSSIE).

In practice, an internal application should not be reachable from the Internet, only from the organization's network or a VPN, preferably authenticated by the machine's identity. The report also distinguishes two types of accounts. Members of the general public usually access only their own data. Staff and contractors, on the other hand, often access a large part of the database, and the compromise of a single one of their accounts can cause considerable damage at once. The appendices give examples of implementation on the technologies encountered during interventions. CERT-FR specifies that these measures do not replace privacy by design, but that they can significantly reduce risks without waiting for legacy applications to be replaced.

Claimed does not mean confirmed

Finally, the document reminds readers that these thefts are often claimed on forums or on Telegram, but that some claims are false or recycle older leaks. It is therefore up to the targeted organization to identify the source of the data before drawing conclusions. This reminder applies to the series of claims in France in recent weeks, including the 25,000 La Poste Mobile customers. CERT-FR says it wants to show that "a large number of compromises are avoidable." The next statistics will tell whether that message was heard.