Hello 😉,
I’m back with a special September–October edition of Récap’IT. The past two months have been quite busy for me with trade shows: we attended the firefighters’ conference (SDIS), then Identity Days in Paris. Plenty to talk about, but no time to write a newsletter in between.
On the news front, the start of the school year has been just as busy. The DGFiP hack made headlines all summer, ANSSI shifted its stance, and the CNIL sanctioned a hospital for a security clearance violation that should serve as a warning to all CIOs. Here’s a roundup.
Enjoy your reading!
Today's schedule:
The CNIL imposes a penalty on a hospital
Go!!
Before we begin, I invite you to follow us ️
524,867 patients were exposed because a single compromised user account provided access to the entire electronic health record. On September 3, 2026, the CNIL fined the Hôpital Privé de la Loire (Ramsay Santé group) 500,000 euros for violations that the CNIL itself described as a “failure to understand essential security principles.”
The mechanism is brutally simple. The institution’s authorization policy did not take into account the concept of a care team: any compromised professional login credentials would grant access to the entire database. The attacker explored the EHR for several days, extracting a massive volume of data, without triggering any alerts. Added to this was permanent access granted to the developer of the Expert Santé software, without prior authorization from the hospital. No zero-day vulnerability, no sophisticated exploit. Just a flat authorization model and a lack of oversight.
What this penalty reminds every CIO—including those outside the healthcare sector—is that the CNIL evaluates access based on proportionality. An account that can view everything the organization stores is a design flaw, not an acceptable risk. And when it takes several days for the detection system to respond, the scope of the data breach becomes the scope of the database.
Sources: CNIL · Digital Solutions · Next.ink
678,000 taxpayers compromised, two months of data extraction without detection, and a hack discovered only because the attacker claimed responsibility for it. The series of events this summer at the General Directorate of Public Finance will go down as a textbook example of what happens when the fundamentals of access security are not in place.
The modus operandi is nothing out of the ordinary. DGFiP agent credentials—likely stolen by infostealers installed on personal devices—enabled two separate intrusions in late June and then in late July 2026. The attacker accessed and extracted tax data from 678,000 individuals and businesses, as well as 200,000 property records. On August 17, a third data breach affected a portal for unclaimed estates. None of this triggered an operational alert; it was the public claim issued on August 12 that revealed the extent of the breach.
The audit report submitted to the Finance Committee on September 4 identifies “several structural vulnerabilities.” These include the proliferation of access channels to DGFiP applications, the use of personal devices by employees, and, above all, the lack of widespread two-factor authentication by 2026 within the agency that holds the income, addresses, and family status information of all French taxpayers. One figure, cited by Director General Amélie Verdier at a press conference, sums up the disparity: 100 cybersecurity positions out of 5,300 IT staff members. Less than 2 percent.
For a CIO, the lesson extends far beyond the public sector. An IT system exposed to thousands of daily connections—without systematic MFA, without granular access segmentation, and without a data exfiltration detection mechanism—is an open door. And when detection relies on the attacker’s claim rather than on internal monitoring, the response time is no longer measured in hours but in weeks.
Sources: Public Sénat · ZDNet · Presse-citron
As a direct result of these summer events, ANSSI is changing course. On September 7, 2026, the agency officially launched REACTIV (Interministerial Response and Action to Data Breaches), a mechanism that, for the first time, gives it the authorityto require ministries to implement immediate measures within strict timeframes. The mandate comes directly from the Prime Minister, who has instructed ministers to comply with the agency’s cybersecurity decisions.
At the same time, the government’s 2026–2027 digital security roadmap has been accelerated: generic accounts will be phased out by June 2026; MFA will be mandatory for administrators by the end of 2026 and for users of sensitive systems by the end of February 2027; and EDR/XDR will be deployed across the entire IT infrastructure.
At the Cybersecurity Conference in October, Vincent Strubel summed up the shift: “ANSSI has never been listened to as much as it is today. We now have a firmer position of authority over the administration. ” The caveat comes in the same sentence: resources remain “limited,” and REACTIV operates “at the expense of other areas of the threat.” Expanded authority without commensurate resources: the equation remains unresolved.
Sources: ANSSI · Journal du Net · Clubic
Receive the best IT news of the month.
Market trends, IT trends, cyberattacks in France... a summary of the news
140 incident response teams, five years of behind-closed-doors discussions about attacks that aren’t documented anywhere. InterCERT France—which brings together the CERTs of Thales, Airbus, EDF, the SNCF, and the Judicial Police—delivers a clear assessment through its president, Thibaud Binétruy: the shift over the past two years can be summed up in one word. Infostealers.
“The major threat we’re seeing in 2025–2026—one that didn’t exist in 2021—is infostealers. ” The major incidents of the summer—starting with the DGFiP hack—all share the same origin: an infection on a personal device, a stolen password, and resold access. The result: several billion accounts will be circulating on the black market by 2026. And since large corporations that have invested in security are better protected, this shifts the threat toward smaller organizations and the supply chain.
What Binétruy identifies as a priority area speaks directly to CIOs. IT systems are expanding into the cloud, to third-party providers, and into SaaS. The only common thread that remains is the corporateidentity . “identity has become the cornerstone of detection.” Identifying a compromised account among 50,000 or 200,000 employees without disrupting everyone’s work: that’s where the ability to respond is put to the test.
Source: Digital Solutions
8.8 million Danes (living and deceased) had their data exposed: names, addresses, and nationalidentity numbers. The Central Population Register (CPR), the equivalent of the civil registry, was scraped between September 10 and 20, 2026, via a service provider with legitimate access. 14 million automated queries were made, with no alerts triggered. The breach was not detected until October 2, when a ministry employee noticed an unusually high invoice.
The entry vector, as revealed by the daily newspaper Politiken: at least three accounts belonging to the service provider Pays ApS— including the administrator account—were protected by the password “123456.” No MFA, no monitoring of request volumes, and no rotation of access credentials for a former employee.
This isn't just an anecdote about password security. It's a textbook example of what happens when a vendor's access falls outside the scope of governance: no mandated credentials policy, no monitoring of usage, and a dormant account that becomes the gateway to an entire national registry.
Source: Clubic
Scheduled for debate in the National Assembly on October 7, 2026, the bill transposing NIS 2 was withdrawn from the agenda the day before. This marks yet another postponement of a bill that was adopted by the Senate in March 2025, passed unanimously by a special committee in September 2025, and has been stalled ever since. The European deadline was October 17, 2024: France is now two years behind schedule.
The European Commission is no longer waiting. On July 8, 2026, it filed a complaint with the Court of Justice of the European Union against France, Ireland, Spain, and the Netherlands, requesting financial penalties. Twenty-three of the 27 member states have already transposed the legislation. On the French side, the sticking point remains Article 16 bis, introduced in the Senate, which prohibits requiring encryption service providers to include backdoors.
For the 15,000 entities falling under the NIS 2 scope (compared to 300 under NIS 1), regulatory uncertainty persists. This does not change the fundamentals: the directive’s requirements have been known since 2022, ANSSI’s ReCyF has been published, and the compliance framework will not change significantly during transposition. Waiting for the vote to launch these initiatives means wasting time that no legislative timeline will be able to make up for.
Would you like to receive our white paper on identity and access management?
No malware, no system breach, no compromised accounts. Revolut voluntarily disclosed the data of 680 customers to an unauthorized third party between September 11 and 12, 2026. The method: an email address from a government agency’s actual domain, used to send fake requests for information. The fintech company treated these as genuine legal requests.
The data stolen is significant: copies of passports, IBANs, and complete transaction histories—including Bitcoin transactions. The targeted customers held large amounts of cryptoassets in Switzerland and France. The attackers then posted files on Telegram, threatening to release more.
This type of attack is not new. As early as 2022, Bloomberg reported that Apple and Meta had suffered the same type of attack via fake emergency requests. What makes the Revolut case significant for any CIO is that the vulnerability lies in the process for verifying legal requests, not in the technical infrastructure. When major platforms receive tens of thousands of requests per year, the screening process relies on trust in the issuing domain. If that trust is not backed by verification of the requester’sidentity , the compliance process itself becomes the vector for data exfiltration.
Sources: Digital Solutions · Journal du Geek
On October 20, Youzer attended Identity Days in Paris. The event featured more than 25 sessions dedicated exclusively to identity and access management—a one-of-a-kind gathering in France on this topic.
What struck us this year was the audience, which extended far beyond the usual circle of IAM experts. This is a sign that identity management is no longer seen as a topic for specialists, but as an operational necessity.
The attacks that have targeted French organizations in recent months confirm this: a compromised legitimate account, a port left open, a password that was never changed. With NIS 2, access control is now also a regulatory requirement. Knowing who has access to what is no longer just a “nice-to-have.”
Youzer was a natural fit for this trade show. The discussions we had confirmed what we see every day: IT teams are looking for a solution that gives them real flexibility while also providing support. That’s exactly what our dual role as both a software vendor and an integrator enables.
The use cases speak for themselves: user lifecycle management, aligning permissions with roles, and linking each account to a specific person. These are concrete topics, and they were the focus of the conversations at the booth.
Thank you to the organizers for this event, which helps raise awareness of the issue.
Thank you for reading me this far!
Any feedback, want to discuss a project?
That's what I'm here for 😉
👉 Did someone forward you the newsletter, and do you think it's great?? Sign up here
Sharing this newsletter is what keeps it alive!
Every month, I send you my findings and my analysis of IT news.
I do a lot of industry monitoring and share it all!
I’m Mélanie, and I’m the marketing manager at Youzer.
About me? I have an insatiable thirst for knowledge! I’d much rather read a book than watch a movie. I’m a huge Harry Potter fan 🧙🏼.
I enjoy running and team sports.