Threat reportData BreachTL-2026-4191
CERT-FR: Web application data breaches in 2025 - low-complexity attacks without technical vulnerability exploitation (CERTFR-2026-CTI-008)
CERT-FR: Web application data breaches in 2025 (TL-2026-4191), also tracked as CERTFR-2026-CTI-008, is a medium-severity data breach, first published 2026-10-22. It has no confirmed attribution, affects Various Web applications processing sensitive data (public, maps to 7 MITRE ATT&CK techniques (T1078, T1119, T1199), and is covered by 9 detection rules and 2 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 2Indicators of compromise
Key facts for TL-2026-4191
- Threat ID
- TL-2026-4191
- Also known as
- CERTFR-2026-CTI-008, CERT-FR application data breach retex
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, health, agriculture, business-services, social-services
- Target regions
- france, Europe
- Detection rules
- 9
- Indicators of compromise
- 2
Malware and tooling in CERT-FR: Web application data breaches in 2025
Malware and tooling: Unidentified 123 (Go Infostealer)
How CERT-FR: Web application data breaches in 2025 works
CERT-FR tracked 196 web application data exfiltrations in 2025 (up from 130 in 2024). Most were enabled by low-complexity attacker actions rather than technical vulnerability exploitation: reuse of legitimate credentials stolen by infostealers or obtained through deception, and data exposed without access control. The disclosed data harms citizens and fuels targeted fraud campaigns.
On 2026-10-20 CERT-FR (ANSSI) published CERTFR-2026-CTI-008, 'Violations de donnees applicatives - Retour d'experience du CERT-FR', an approximately 80-page lessons-learned report. It follows CERTFR-2024-CTI-009 (2024-09-24), which covered mass data exfiltration in the French social sector. The new report covers incidents handled in 2025 and early 2026 and focuses on web applications that process sensitive data. It is an aggregate retrospective, not a single campaign: it names no CVE, threat actor, malware sample or network IOC in the material available.
CERT-FR handled 196 application data exfiltrations in 2025 versus 130 in 2024. Secondary coverage of the report states that the attacker most often enters with legitimate credentials, either stolen by infostealer malware on personal or professional workstations or obtained by social engineering, or simply finds data that is exposed without access control. No sector preference was observed. Documented patterns include: a single compromised user account of an online health service used to abuse its APIs (May 2025); agri-food companies hit in February 2025 after employees installed a fraudulent Word-to-PDF converter that delivered an infostealer; public-service data exfiltrated in late 2025 using credentials stolen from users' personal devices; laboratory analysis results stolen through a compromised account of a third-party provider operating a results-viewing system; and a medical data company whose patient data was exposed after a server maintenance error. Reported root causes include legacy applications designed without modern access control, weak authentication (password-only), weak API isolation, insufficient privilege management and inadequate logging and monitoring. Organizations are said to underestimate the abuse potential of legitimate login/password pairs in attacker hands.
The report is organized as security principles, technical annexes with implementation examples, and ten risk-reduction approaches for existing applications. As summarized by secondary sources, these include: least privilege and limits on session count and duration; request rate limiting and alerting on abnormal volumes (example threshold: alert beyond 50 consultations); restricting internal applications to organizational networks or VPN and geofencing public applications; multi-factor authentication or passkeys instead of password-only login; binding sessions to device, browser and connection source (e.g. invalidation on IP or User-Agent change, device-bound session credentials); centralized logging with original source addresses and at least six months of retention (Syslog RFC 5424, ISO 8601 timestamps); automated detection and response for impossible travel, enumeration and volumetric anomalies; data inventory, data-flow mapping and privacy by design; encryption of exports and backups and deletion of obsolete data; and third-party/provider security audits with contractual protections. Governance points include management accountability, regular audits, using production-like test data instead of real data, and RGS/homologation compliance for French administrations.
Analyst note: the report PDF could not be machine-parsed during this research, so technique detail comes from the CERT-FR landing page and four independent summaries. Severity MEDIUM is an analyst assignment; the source gives no rating. Related context, not part of this report: CERT-FR's REACTIV situation report CERTFR-2026-CTI-006 (2026-09-30) counted 99 reported violations since 1 August (67 confirmed) in French ministries and listed unpatched software, IDOR, weak or missing MFA, infostealer credential theft and subcontractor compromise as recurring causes.
MITRE ATT&CK techniques used in TL-2026-4191
Initial Access
T1078 Valid Accounts; T1199 Trusted Relationship; T1566 Phishing
Collection
T1119 Automated Collection; T1213 Data from Information Repositories
Execution
T1204.002 User Execution: Malicious File
Credential Access
T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Affected products and versions in CERT-FR: Web application data breaches in 2025
- Various — Web applications processing sensitive data (public administration, healthcare, agri-food, business services, subcontractors)
Vulnerable versions: Applications relying on password-only authentication, weak access control or exposed data
Remediation for CERT-FR: Web application data breaches in 2025
Immediate actions
- Inventory web applications that process sensitive data and review who and what can query them
- Enable rate limiting and alerting on abnormal request volumes per account (CERT-FR example: alert beyond 50 consultations)
- Restrict internal applications to the organizational network or authenticated VPN and apply geofencing to public applications
- Ensure no database, API or export is reachable without access control
Workarounds
- Revoke and rotate credentials of accounts exposed by infostealer infections and force re-authentication
Longer-term hardening
- Replace password-only authentication with MFA or passkeys, ideally through a centralized identity provider
- Apply least privilege by business role and limit concurrent sessions and session duration
- Bind sessions to device, browser and connection source and invalidate them on IP or User-Agent change
- Centralize logs with original source IPs and retain at least six months
- Automate detection and response for impossible travel, enumeration and volumetric anomalies
- Encrypt exports and backups, delete obsolete data and use production-like test data instead of real data
- Audit third-party providers and add contractual security obligations
Weaknesses (CWE) in CERT-FR: Web application data breaches in 2025
Timeline of CERT-FR: Web application data breaches in 2025
- CERT-FR publishes CERTFR-2024-CTI-009 on mass personal-data exfiltration in the French social sector (2023 - early 2024).
- February 2025: agri-food companies targeted after employees install a fraudulent Word-to-PDF converter that delivers an infostealer (day approximate; source gives month only).
- May 2025: an online health service is compromised through a single user account used to abuse its APIs (day approximate; source gives month only).
- Late 2025: public-service data is exfiltrated using credentials stolen by infostealers on users' personal devices (date approximate).
- CERT-FR publishes the first REACTIV situation report (CERTFR-2026-CTI-006) on data violations affecting French ministries; related context for the same trend.
- CERT-FR publishes CERTFR-2026-CTI-008: 196 web application exfiltrations in 2025 (vs 130 in 2024), mostly low-complexity and without vulnerability exploitation, with ten risk-reduction approaches.
Sources cited for CERT-FR: Web application data breaches in 2025
- CERT-FR: Violations de donnees applicatives - Retour d'experience du CERT-FR (CERTFR-2026-CTI-008)
- CERTFR-2026-CTI-008 (PDF)
- CERT-FR: Exfiltration de donnees du secteur social - Retour d'experience (CERTFR-2024-CTI-009)
- LeMagIT: Violations de donnees a repetition - l'Anssi fait son bilan et donne ses conseils
- IT Social: Violations de donnees, la plupart des exfiltrations passent par des identifiants legitimes
- Metametris: Fuites de donnees applicatives - Synthese du RETEX CERT-FR
- Mallory: CERT-FR Issues Web Application Security Guidance After Tracking Nearly 200 Data Breaches
- Leto Legal: Faille Metabase - neuf instances ministerielles compromises, bilan REACTIV (related context, CERTFR-2026-CTI-006)
- CERT-FR: Panorama de la cybermenace 2025 (CERTFR-2026-CTI-002)
Detection coverage for TL-2026-4191
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4191 across Splunk SPL, Microsoft KQL and Sigma, covering 2 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.