Hacker stole data on 1.2m bank accounts from French government accounts repository

The French government confirmed on Wednesday that an unknown third party gained access to FICOBA, a centralised, computer-based, national registry of all bank accounts, and stole data related to 1.2 million accounts.

 

The Ministry of Economy said in a press release that a malicious actor gained access to the credentials of a government official who had access to the framework for the exchange of information between ministries.

 

Using the credentials maliciously, the hacker was able to access FICOBA, the French government’s centralised, computer-based, national registry of all bank accounts, savings accounts, and rental safes opened, modified, or closed within France, and stole data associated with approximately 1.2 million bank accounts.

 

The ministry said that the national bank account file contained personal information like account holders’ names, addresses, and in some cases, their tax identification data.

 

"Upon detection of this incident, immediate access restrictions were implemented to stop the attack, limit the amount of data accessed and extracted from this database — which reportedly includes 1.2 million accounts — and prevent any further unauthorised access," the ministry said.

 

"Work is underway to restore service with optimal security. Affected users will receive individual notifications in the coming days alerting them that their data may have been accessed. Contact has already been established with banking institutions in order to raise customer awareness of the need for increased vigilance."

 

The national file of bank accounts, also known as FICOBA, lists all current accounts, savings accounts, securities accounts as well as details of safes rented in France. Entries related to each account list the identity and address of the account holder, the type of account and the date and nature of the account. Citizens cannot object to the registration of their accounts in the FICOBA file.

 

The Ministry of Economy said IT teams from the Ministry of Finance, the national cyber security agency and the French Public Finances Directorate were mobilised to address the incident and strengthen the security of information systems. The ministry has also reported the incident to CNIL, the National Commission for Information Technology and Civil Liberties, in compliance with GDPR.

 

The ministry has warned citizens not to fall for scams originating from text messages or emails asking them to share their personal or financial information, and not to share their bank card or login details with anyone claiming to be a government official.