On February 18, 2026, the French Ministry of Economy and Finance disclosed that a malicious actor illegally accessed the national bank account registry, FICOBA, exposing sensitive data for approximately 1.2 million accounts.
Key Incident Details
- Method of Breach: The attacker used stolen login credentials belonging to a single civil servant to gain unauthorized access.
- Timeline: The intrusion began in late January 2026 and remained active for several days before being detected and terminated.
- Data Exposed: The breach involved personal and financial information, including:
- Account holder identities (First and last names).
- International Bank Account Numbers (IBANs).
- Postal addresses.
- Tax identification numbers (in some cases).
- Registry Scope: FICOBA is a massive database managed by the Directorate General of Public Finances (DGFiP) that tracks all bank accounts opened in France, covering over 80 million individuals.
Risk Assessment and Response
- Limited Access: Officials emphasized that the attacker could not view account balances, consult transaction history, or initiate banking operations.
- Primary Risks: The French Banking Federation warned that the stolen data could be exploited for identity theft, highly targeted phishing campaigns, or the setup of fraudulent direct debit payments.
- Official Actions:
- A criminal complaint has been filed.
- The French Data Protection Authority (CNIL) was formally notified.
- Impacted individuals are being contacted directly by the government to alert them of the exposure.
Recommendations for Account Holders
The French Banking Federation and authorities advise the following precautions for those affected:
- Monitor Transactions: Regularly check bank statements for any unauthorized activity or unfamiliar direct debits.
- Be Vigilant: Be cautious of suspicious emails, SMS, or phone calls from individuals posing as bank representatives or creditors.
- Report Anomalies: Immediately alert your financial institution if you detect any suspicious account activity.
