🔴 After the DGFiP and Ministry of Education Hacks

How to respond to the cyber crisis hitting France's major administrations is now the question on everyone's mind. What should be done now? And in the fall, once the picture is clearer?

But also, to what extent will these incidents affect the platforms for the next presidential election? Put simply, will it be possible to vote for someone who has skipped over these subjects?

Let me reassure you right away: this newsletter builds on a LinkedIn post I published just afterward, but with a few updates, because the recent news is not good.

Lots of requests from TV channels, but I preferred to send a few people instead, notably some of our members, far better informed than I am about how things work inside the major administrations.

One of BFM TV's programmers confided to me that the subject goes down very well with audiences. So there will be more shows: strip out the technical side and you are back to how the administration is organized and who is responsible, a terrain where everyone has an opinion, and I gather they are very firm ones.

And as a bonus, a document prepared with our members: "Cyber in France: what already exists," an inventory of the state's cyber structures that has had the once-over from leading experts and senior civilian and military officials, to help us better understand where the cyber response stands.

A digital threat hanging over the new school year

This summer, the government will have had to face two major crises: a wildfire crisis, after a string of exceptional heat waves, and a series of hacks hitting some of the state's most important services, on a scale we had never seen before.

Because the chain of hacks keeps getting longer. Two administrations account for most of it: the Ministry of Education and the DGFiP (the French tax administration). Let's take them in order.

The Ministry of Education

The intrusion dates from the night of July 25, via a VPN, and affects all of the académies, the regional education authorities. On August 18, the ZeroBytes group, already behind the DGFiP data theft, claimed it and put the data online: 346 million raw rows, with, according to its claim, more than 4 million staff credentials and the data of about 1.2 million pupils, over a period of more than twenty years. The ministry is still verifying.

The hackers' message sums up the situation: "You detected me, but you didn't cut me off."

And it's not the first time. Last April, the ministry had already acknowledged a leak of pupil data via the ÉduConnect service, born of an account takeover in late 2025 and a flaw exploited just before it was patched. Twice in four months: that is no longer an accident, it's a repeating pattern.

The consequences are no longer just stolen data, they are operational. Ten days before the start of the school year, the security measures are blocking the work of school heads: email and business applications suspended in several académies, principals unable to send the supply lists to parents, to contact teachers ahead of the pre-term days, to track staff assignments or to pay the invoices received over the summer. One of them describes himself in Le Monde as "furloughed." The ministry speaks of services being gradually restored.

Why so long?

A friend who knows the institution explains it to me: each of the thirty académies has its own security systems and does not apply the same level of lockdown while the necessary checks and hardening are carried out. Hence very uneven situations, again according to Le Monde: Paris and Versailles are barely affected, Nantes, Toulouse and Bordeaux much more so.

Thirty académies, thirty systems: that is precisely the harmonization challenge we set out below for the ministries.

The DGFiP, three leaks

• The first: the theft of 678,000 tax files of individuals and companies. Above all, it revealed a detection problem: the compromised accesses had been identified and cut off as early as June and July, but the administration had not detected the extraction of the data. It is the exact mirror image of the Ministry of Education: here, they cut off without seeing; there, they saw without cutting off.
• The second: on July 29, a month after the first was blocked, the land registry data server. Up to 433,485 individuals and a thousand professionals according to Bercy, about 2 million accounts according to the hacker's claim.
• The third: detected on Monday, August 17, on the register of unclaimed estates, quickly cut off according to the administration.

The Minister for Public Accounts, David Amiel, ended up issuing a public apology: "what happened is unbearable for the French people."

And the list keeps growing

The same group claimed this summer the French Handball Federation, Intermarché and a platform linked to Santé publique France, the national public health agency. INSEE, the national statistics institute, saw its internal directory expose 12,800 employees. And it spills beyond the state's perimeter: Alaxione, a private e-health platform, is the subject of a claim covering 6.8 million patients.

The Prime Minister's measures

Following the DGFiP hack, Sébastien Lecornu convened an interministerial crisis cell on August 17, after an initial statement from Matignon on August 15.

The gist of the announcements comes down to six points:

• an in-depth audit of the DGFiP by ANSSI (France's national cybersecurity agency), in parallel with the judicial investigation, with initial operational measures to be presented in September;
• individual notification of every affected individual or company, with the precautions to take against the risks of phishing, identity theft or fraud;
• acceleration of the state digital security plan launched on April 30, 2026, which notably earmarks €200 million for cybersecurity;
• 5% of each ministry's digital budget devoted to cybersecurity from 2027, versus about 1% today: going from 1 to 5 makes concrete what "accelerate" means;
• the creation of ARIANE, a new state digital authority born of the merger of DINUM (the government's interministerial digital directorate) and the DITP (the public transformation directorate), reporting to the Prime Minister, planned before January 1, 2027;
• 40 priority actions across the administrations, including self-attack exercises and greater use of AI to detect vulnerabilities, with Matignon following up every three months.

One detail matters: the fines from the CNIL (the French data protection authority) that are supposed to help with the funding will not come from the state itself, since Article 20 of the Informatique et Libertés law, France's data protection act, excludes state data processing from administrative fines. France Travail, the public employment agency, was fined €5 million in January for its data leak. The DGFiP, for its part, risks nothing.

Latest development: in a letter dated August 19 to the Secretary-General for Defense and National Security, the Prime Minister asked for the creation of a new unit to fight cyberattacks, a contact team made up of ANSSI staff and tasked with intervening on the front line whenever a serious breach of the state's information systems is suspected. "We must regain the initiative on the ground," he writes, while acknowledging that few ministries are at the required level. And he sums up: "Let's stop discovering the obvious with every cyberattack."

The press is now asking the same question, right down to its headlines: a new cyber unit, but what for?

In Parliament, the pressure is mounting: Socialist senators are demanding a commission of inquiry, and La France insoumise is asking for the same thing through Mathilde Panot.

In the end there isn't much that is new in these announcements, and they are extremely disappointing. And yet, I have a rather good opinion of the Prime Minister.

My feeling is that the government seems to be betting that citizens have a poor understanding of how cybersecurity works, and that a somewhat official crisis meeting accompanied by a few general announcements will be enough to calm the worries. I don't know whether that will be enough to reassure, but mid-August is never the time for grand maneuvers, except on the side of the firefighters, who are working without respite.

The only immediately important measure for the people concerned, though it is almost self-evident, is to quickly contact the taxpayers whose data has been compromised.

Here, in that spirit, are a few communication ideas that seemed essential to me and that can serve as the premises of a major cyberdefense plan for the state and its citizens. I have organized them in three stages: the emergency, the fall, 2027.

Stage one: responding to the emergency

1. A cell dedicated to victims

Announce the creation of a cell bringing together the gendarmerie, the police and ANSSI, devoted exclusively to the attacks French citizens could fall victim to following a data breach. Let me remind you that the addresses of French people are, right now, being sold to cybercriminals, and we need to show we are being proactive.

This cell doesn't need to be permanent, nor to become a new structure, nor to have a lot of staff: the mission can perfectly well be entrusted to a structure that already exists, and I am sure the ComCyber, the military cyber commands, have their own ideas on the matter.

What matters is that the French know there is an entity with police powers doing OSINT on the darknet, that is, open-source intelligence, linking possible burglaries or phishing attempts to the databases put up for sale, and tracking how they evolve. It must now be given the means to do this work effectively. The new unit announced on August 19 by the Prime Minister will act on the state's systems. The cell I am proposing deals with citizens.

2. Get all the technical leaders around the table

Summon all the ministries' CTOs and CISOs around the table to present them with the work plan ahead. A meeting with ANSSI is the bare minimum, and it is not enough to show that the subject has become a priority.

Then set up monthly meetings that list the problems and the means of solving them at a global level, to finally have a real analysis of the situation, without doublespeak or politics. We knew how to do it at one point, in the second part of the Covid crisis. We need to reconnect with reality, not with talking points. These meetings would start with the question of access, notably interministerial access. It's not the only reason, but it is one of the reasons so many systems were penetrated.

The goal is to harmonize procedures and impose a clear security doctrine. Nobody should be able to connect from one ministry to another ministry's service without the security procedures having been harmonized. The message to get across to the public: no more improvisation, no more silos, no more responsibilities diluted in the technical details. Everyone must work hand in hand.

Stage two: the September return

That is when the conclusions of the ANSSI audit and the promised first operational measures are due. It is also the time of the parliamentary calendar.

One concrete project already has a date: David Amiel has asked DINUM to have sovereign AI tools for automated vulnerability discovery operational by September. Good idea, but it immediately raises the question of the engine: to be at the right level by September, we urgently need Chinese models, rather than waiting for Mistral to reach the frontier. I come back to this in stage three.

3. Get the Resilience/NIS2 law passed

Bring back around the table all the players in the Resilience/NIS2 law: Anne Le Hénanff, the minister delegate for artificial intelligence and digital affairs, the chairs of the special committees Philippe Latombe and Olivier Cadic, and the rapporteurs Éric Bothorel, Mickaël Bouloux and Catherine Hervieu. All under the authority of the Prime Minister, who must settle the question of backdoors, the hidden entry points into encrypted messaging apps that are holding up the law. The goal: finally announce a date for presenting it to the National Assembly. The minister was herself the bill's rapporteur before joining the government in October 2025.

Few French people know it: their physical safety can be held hostage by a law not being passed. The day they understand that, they will be furious. If the law is not on the fall calendar, then the minister should bear the consequences.

Stage three: 2027

4. Prepare France for cybersecurity in the age of AI

Let's be clear: in 2027, all the infrastructure that has existed since the 1990s is going to be vulnerable to AIs. It is a schism far deeper than the potential quantum question in 2030.

France sees itself as an AI leader when we are, in reality, a middling-to-small power in this field. So the scattering has to stop.

The relationship between AI and the future of security has not been optional since the hack of Hugging Face by OpenAI's models, which escaped their test environment last July. The silos have to go. We already have the PEReN (the government's center of expertise on digital regulation), which works on algorithmic questions, the LINC, the CNIL's lab, which produces interesting things, and ANSSI's own, which can't be bad either.

We need to announce much stronger coordination between these players and the cybersecurity players within the state, and give them access to frontier Chinese models. By frontier model I mean a model at the global state of the art, the one our adversaries would use. If I understand correctly, INESIA, the national institute for the evaluation and safety of artificial intelligence, already brings together ANSSI, Inria, the LNE and the PEReN, among others. Part of this coordination therefore already exists, but its objectives and its return on investment are not clear to all French people.

The question we need to be able to answer is simple: if France is attacked by AIs, are we capable of defending it with AIs of an equivalent level? If that is still not the case in 2027, then we have a real problem, and the people in charge of the AI strategy, the one that led us straight into the wall, will have to draw the consequences too.

5. Reorganize digital governance

Finally, the question of digital governance has to be reorganized, forcefully.

It always pains me to say this as a former vice-president of the Conseil national du numérique (the National Digital Council), but all the pointless committees have to go. In my day, the Conseil national du numérique's purpose was to help, in an advisory capacity or on its own initiative, with draft legislation. That notably produced Axelle Lemaire's digital law. Today, the CNNum has pivoted and plays no more than a think tank role.

Reports are nice, but anyone can write reports. What matters today is that the government has somewhere capable of advising it on the digital impact of laws. If the Conseil national du numérique in its old version, the one Jean-Baptiste Souffron had imagined, still existed with its way of working, most of the laws touching on digital matters, the SREN law on securing and regulating the digital space, the Resilience/NIS2 law on the resilience of critical infrastructure and the strengthening of cybersecurity, the law banning social media for under-15s, would certainly have benefited from a useful counterpoint.

6. Massively secure access

This crisis must be the starting point of a strong security hardening policy.

The example exists: since Google equipped its employees with YubiKey-type physical keys, not a single account has been compromised by phishing since 2017, across 85,000 people.

We need the same thing at national scale: strong authentication for citizens as well as public employees, mandatory for paying your taxes as for every state access. The YubiKey is only the technical means.

And as with the Minitel, where the state provided the terminal, hand out the key: at twenty dollars apiece, ten million keys cost the €200 million the government announced.

Bercy has started, on the employee side: two-factor authentication across the board, lookup quotas on sensitive files, AI to detect unusual behavior, a bug bounty. That's good, but it only concerns the employees of one administration.

Update: several readers who work on these systems point out to me that everything already exists, off the shelf:

• the YubiKey-type key exists in a French version: many point to NEOWAVE's Winkeo, produced near Aix-en-Provence with an ANSSI security visa. It complies with FIDO2, the global standard for physical-key authentication, the one Google, Apple and Microsoft already use;
• the service to use it exists: ProConnect, the FranceConnect for public employees and professionals, already accepts keys using that standard, and hooking it up to a state service is a few hours' work for a developer;
• the consumer infrastructure too: FranceConnect+ and France Identité have already put everything into production, nothing is deployed at scale;
• even the timetable exists: ANSSI's roadmap requires multi-factor authentication on sensitive systems before February 2027, everywhere before February 2028.

There is nothing to invent. We just had to get on with it.

7. Digital sovereignty and critical systems

We should identify the antediluvian systems that still control essential state functions, organize their replacement and, where relevant, fund open-source software to make alternatives easy to deploy.

Replacing old Windows systems with Linux systems would increase security. It is a subject that will have to be approached otherwise than through press releases.

8. Change the AI strategy, urgently

The other big subject is the AI strategy. For nearly all the players I have spoken to, "Mistral Only," the government's current line, has severely limited our options.

The observation is simple: we have no deterrence in the AI era. A credible cyberdefense presupposes access to models at least comparable to those that will be used against us, to defend ourselves, but also to audit the damage done by other AIs.

Yet all we have are middling products, far from the frontier. And we are stuck between two blocs:

• the United States, which wants to sell us, at a high price, products that will lack the features needed to do cyber;
• China, which makes its models freely available, but without France having the infrastructure to run them or the agreements guaranteeing access to the most advanced versions.

These Chinese models are today "open weight": their parameters can be downloaded and modified by anyone. Nobody knows whether that will last, China follows its own objectives. It is therefore vital to create French and European strains of them right now, "forked" copies of the best Chinese and American models, that we control.

It has to be said clearly: data leaks are not the top of the threat. What should really worry us is state hacking. The Telegraph has just revealed that hackers linked to Iran shut down a British power plant for four days, a first, while a wave of attacks hit the water infrastructure of twelve American states.

No casualties, no panic, that was precisely the point: showing they can do it. The day they want to hurt, they will know where to press.

Insecurity no longer exists only in the physical world and, curiously, those who claim to fight it are far too quiet about their cyber strategy.

Where did the billion from Emmanuel Macron's cybersecurity plan go?

Let's remember: in February 2021, after the attacks on the hospitals of Dax and Villefranche-sur-Saône, Emmanuel Macron announced a €1 billion cybersecurity plan through 2025, including €720 million in public funding. Most of it targeted the industrial sector, tripling its revenue, doubling its headcount, producing unicorns, not securing the state's systems.

Five years later, the DGFiP and the Ministry of Education fall, and one has the impression that nothing went the way it should have.

Provisional conclusion: learning to live with hybrid insecurity

The security of the French must now be thought through in two universes: the physical world and the digital world.

It will be one of the essential subjects of 2027, and I am not sure the government has made the connection yet.

I asked the question at the opening: will it be possible to vote for someone who has skipped over these subjects? No. In 2027, a candidate without a cyberdefense plan will not be a serious candidate.

And you, what do you think?

Bonus for paying members