Hello ️😊,
I'll see you again for the July–August issue of Récap'IT.
This summer, France’s cybersecurity took a beating from all sides. Incidents occurred one after another, all sharing a common thread: a compromised legitimate account, a poorly supervised service provider, or a lack of MFA. In this issue, we take a look back at the summer wave of attacks and the 43.4 million accounts that make France Europe’s top victim. We also dissect a phishing server left open that reveals the industrial-scale circumvention of MFA, a museum still operating in degraded mode a year after an attack, and a ransomware group that’s accelerating its intrusions by 50% thanks to an off-the-shelf AI agent. On the Youzer front, the return of work-study students serves as a reminder that every account not deactivated in time remains an open door.
Enjoy your reading!
📅 On the agenda today:
👉 Go !!
Before we begin, I invite you to follow us 👉️
DGFiP, SFR, Intermarché, Lidl, Bloctel, Tchap, the French Ministry of Education. The list of French organizations compromised between June and August 2026 reads like a Prévert-style inventory—except that each entry represents hundreds of thousands of pieces of personal data. What these incidents have in common is not the sophistication of the attacks, but their ordinariness.
At the DGFiP, the June 26 breach exploited the stolen credentials of an employee and then an authorized third party: 678,000 tax records were extracted, including income, addresses, and correspondence with the administration. A second breach involving land registry data followed, then a third on a public portal (FrenchBreaches, August 2026). At SFR, a single internal account was enough to gain access to the fiber connection management tool and extract 2.1 million customer records (claim made on July 17, 2026). At Intermarché, unauthorized access to files on the Drive service exposed 287,605 customers (confirmed on August 3). At Lidl, the breach occurred through an external service provider, without the retailer ever having had access to the compromised account (notification dated July 10). On Tchap, the government’s secure messaging service, a single hijacked user account granted access to unencrypted public chat rooms: 643,000 messages and the metadata of 73,000 agents, according to the claim (DINUM, June 8, 2026). Bloctel shut down on August 11 with 3 million leaked phone numbers; access was gained through a business account lacking MFA.
What strikes a CIO about this sequence is how often the same scenario repeats itself. No zero-day vulnerabilities. No custom exploits. A legitimate account that’s been hijacked, a vendor whose access isn’t being monitored, and no or only partial MFA. The question is no longer whether your organization will be targeted, but how many active accounts in your IT system are currently not subject to regular reviews of their permissions and access rights.
Sources: FrenchBreaches, L'Usine Digitale, DINUM, cyberattaque.org, INCYBER News
43.4 million compromised accounts in six months. Between January and June 2026, France emerged as the European country most affected by data breaches, accounting for more than half of all hacked accounts on the continent. Globally, only the United States fared worse. These are the findings of a Surfshark study published in July 2026.
The pace is dizzying: nearly three compromised accounts every second, and a 62.3% increase compared to the second half of 2025. In just six months, the annual record set in 2025 (40.3 million accounts) has already been surpassed. Relative to its population, France has the highest density of compromised accounts in the world: every French citizen has been affected by approximately 11 data breaches since 2004.
Researchers at Surfshark point to a shift in targeting. Cybercriminals are turning to targets perceived as more accessible, particularly public institutions. In France, ANTS, Parcoursup, the Ministry of National Education, and Service-public.gouv.fr were all affected in the first half of the year. The government responded by allocating 200 million euros to secure government systems.
What should concern a CIO beyond the raw volume is the persistence of stolen data. A credential stolen in 2023 could resurface in a credential stuffing campaign in 2026. The question isn’t just “have we been compromised,” but: How many credentials from past data breaches are still valid in your directory? Without a mandatory rotation policy and active monitoring of exposed credential databases, every past data breach remains an open door.
Source: 01net / Surfshark study, July 2026
Receive the best IT news of the month.
Market trends, IT trends, cyberattacks in France... a summary of the news
44% of French small and medium-sized enterprises (SMEs) have suffered at least one cyberattack in the past twelve months. At the same time, 78% say they are confident in their level of resilience. This discrepancy is documented in an ESET study conducted among 500 decision-makers involved in their organizations’ cybersecurity decisions (ESET France study, 2026).
The attack vectors are nothing out of the ordinary. Phishing remains the leading cause (31%), followed by the exploitation of unpatched vulnerabilities (24%) and flaws in access and user account management (20%). No spectacular zero-day exploits, no compromised supply chains: it’s basic security practices that have been neglected that leave the door open. In terms of impact, data loss is the top concern (51%), ahead of direct financial consequences (42%) and business disruptions (33%). Among the affected companies, 12% were targeted multiple times during the same period.
AI adds a layer of complexity. Malware that exploits AI is identified as the most concerning emerging threat (36%), ahead of credential theft (34%) and enhanced phishing (23%). Two-thirds of the SMEs surveyed are already integrating AI into their operations, but 72% acknowledge that it introduces additional security risks.
What makes these findings troubling for a CIO is the third vector. We’re familiar with phishing. We have to deal with delayed patches. But a failure involving access and accounts is a governance issue: who has access to what, since when, and who verifies it? When a compromised account can move freely because no one is monitoring the assigned permissions, the confidence placed in the system’s resilience becomes a blind spot. The 78% of SMEs that feel secure would benefit from testing that confidence against a real audit of their access permissions.
Source: Le Monde Informatique
A phishing operator launches a Python HTTP server in Budapest and forgets to disable file indexing. Attack configurations, victim logs, remote control tools, and a personal Telegram session—all freely accessible. The cyber intelligence team at Lexfo, a French company, spots the open directory and traces the trail. Their findings, published on July 13, 2026, describe three independent operators sharing the same infrastructure to bypass MFA on Microsoft 365: a reverse proxy intercepting session cookies after two-factor authentication, and abuse of the OAuth Device Code flow, where the victim authenticates on the real portal while the attacker retrieves the token. Results: 218 compromised business accounts across 12 countries, 94% of which were corporate email accounts. Traces of generative AI appear in the code, and the components can be purchased for a few hundred dollars on Telegram.
When MFA bypass is industrialized and sold as a turnkey solution, the answer is no longer a simple code sent via text message. It requires phishing-resistant methods: FIDO2, passkeys, and active monitoring of session tokens.
Source: Les Numériques / Lexfo report, July 2026
On July 28, 2025, a cyberattack shut down all of the National Museum of Natural History’s digital systems. No more email, no more phone service, and no access to financial systems or scientific databases. A year later, the institution still hasn’t recovered.
Administrative services have been restored, but the landline telephone network remains down outside the Jardin des Plantes, printers are disconnected, leave requests are being processed manually, and staff can no longer access their personnel files. In the laboratories, due to the lack of centralized servers, researchers are sharing their results via USB drives or hard drives. Major biodiversity databases remain inaccessible. The institution, which operates across thirteen sites in France, hopes to return to normal “sometime this fall.”
This case illustrates a reality that incident response plans systematically underestimate: the actual time required for recovery. Not the time mentioned in the press release on Day 3, but the months of degraded operations during which every workaround creates a new risk. Researchers copying data to unencrypted storage media so they can continue working—this is exactly the kind of security debt that an attack generates long after it has been contained.
Source: Le Monde, August 2026
Would you like to receive our white paper on identity and access management?
A ransomware group that uses a consumer-grade code editor to carry out its attacks. Not a lab prototype, not a custom-built tool: Cursor, an AI-powered coding assistant accessible to anyone, has been hijacked to scan networks, steal credentials, and escalate privileges—30 to 50 percent faster than a human operator working alone. This is what analyses by Gambit Security and CloudSEK, published on August 27, reveal based on an exposed server belonging to the Russian-speaking group Aur0ra. More than 20 organizations in nine countries were targeted between April and July 2026.
When the agent refused an action deemed malicious, the attackers would restart the conversation by presenting the request as a "security test." The technique worked almost every time.
Meanwhile, OpenAI has suspended development of its upcoming Astra model after concluding that it might be capable of discovering zero-day vulnerabilities and carrying out end-to-end attacks without human intervention. It is the first model in history to come close to this threshold.
For a CIO, the equation is simple: if a commercial tool makes an attacker twice as fast, the time your teams have to detect abnormal behavior on a privileged account is cut in half.
Sources: The Hacker News, Cybernews, OpenAI, Solutions Numériques
On August 31, thousands of work-study contracts end. On September 1, just as many begin. In between, there’s a question that few CIOs ask themselves in time: What happens to the accounts, access rights, and associated permissions?
Work-study students are a unique group when it comes to identity management. While they are with the company for one or two years, they accumulate access privileges just like employees on permanent contracts. But because they are viewed as temporary, their lifecycle is often managed with less rigor. The result: accounts that remain active after the contract ends, permissions that are never revoked, and application access rights that linger in the directory without anyone paying attention to them. These are exactly the types of dormant accounts that an attacker targets first.
An IGA solution like Youzer enables you to automate provisioning and deprovisioning based on contract dates. The account is created on day J, with the rights associated with the position. It is deactivated on the end date, without manual intervention and without any oversights. New hires are no longer a blind spot—they become a process managed just like any other HR transaction.
When the number one cause of security breaches in the summer is a compromised legitimate account, every account that isn't deactivated in time is a door left wide open.
Thank you for reading me this far!
Any feedback, want to discuss a project?
I'm here for that 👋.
Did you get forwarded the newsletter and think it's great? Sign up here 👇
Sharing this newsletter is what keeps it alive!
My name is Mélanie!
I'll give you a rundown of everything I've been able to go through and read over the past month, and I'll summarize the most interesting news stories for you.
I work in marketing at Youzer.
You can follow me on LinkedIn.
Every month, I send you my findings and my analysis of IT news.
I do a lot of industry monitoring and share it all!
I’m Mélanie, and I’m the marketing manager at Youzer.
About me? I have an insatiable thirst for knowledge! I’d much rather read a book than watch a movie. I’m a huge Harry Potter fan 🧙🏼.
I enjoy running and team sports.