# CERT-FR: Web application data breaches in 2025 - low-complexity attacks without technical vulnerability exploitation (CERTFR-2026-CTI-008)

> CERT-FR tracked 196 web application data exfiltrations in 2025 (up from 130 in 2024). Most were enabled by low-complexity attacker actions rather than technical vulnerability exploitation: reuse of legitimate credentials stolen by infostealers or obtained through deception, and data exposed without access control. The disclosed data harms citizens and fuels targeted fraud campaigns.

- **Published:** 2026-10-22T22:12:30Z
- **Last reviewed:** 2026-10-22T22:12:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4191
- **ID:** TL-2026-4191
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 2 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-20 CERT-FR (ANSSI) published CERTFR-2026-CTI-008, 'Violations de donnees applicatives - Retour d'experience du CERT-FR', an approximately 80-page lessons-learned report. It follows CERTFR-2024-CTI-009 (2024-09-24), which covered mass data exfiltration in the French social sector. The new report covers incidents handled in 2025 and early 2026 and focuses on web applications that process sensitive data. It is an aggregate retrospective, not a single campaign: it names no CVE, threat actor, malware sample or network IOC in the material available.

CERT-FR handled 196 application data exfiltrations in 2025 versus 130 in 2024. Secondary coverage of the report states that the attacker most often enters with legitimate credentials, either stolen by infostealer malware on personal or professional workstations or obtained by social engineering, or simply finds data that is exposed without access control. No sector preference was observed. Documented patterns include: a single compromised user account of an online health service used to abuse its APIs (May 2025); agri-food companies hit in February 2025 after employees installed a fraudulent Word-to-PDF converter that delivered an infostealer; public-service data exfiltrated in late 2025 using credentials stolen from users' personal devices; laboratory analysis results stolen through a compromised account of a third-party provider operating a results-viewing system; and a medical data company whose patient data was exposed after a server maintenance error. Reported root causes include legacy applications designed without modern access control, weak authentication (password-only), weak API isolation, insufficient privilege management and inadequate logging and monitoring. Organizations are said to underestimate the abuse potential of legitimate login/password pairs in attacker hands.

The report is organized as security principles, technical annexes with implementation examples, and ten risk-reduction approaches for existing applications. As summarized by secondary sources, these include: least privilege and limits on session count and duration; request rate limiting and alerting on abnormal volumes (example threshold: alert beyond 50 consultations); restricting internal applications to organizational networks or VPN and geofencing public applications; multi-factor authentication or passkeys instead of password-only login; binding sessions to device, browser and connection source (e.g. invalidation on IP or User-Agent change, device-bound session credentials); centralized logging with original source addresses and at least six months of retention (Syslog RFC 5424, ISO 8601 timestamps); automated detection and response for impossible travel, enumeration and volumetric anomalies; data inventory, data-flow mapping and privacy by design; encryption of exports and backups and deletion of obsolete data; and third-party/provider security audits with contractual protections. Governance points include management accountability, regular audits, using production-like test data instead of real data, and RGS/homologation compliance for French administrations.

Analyst note: the report PDF could not be machine-parsed during this research, so technique detail comes from the CERT-FR landing page and four independent summaries. Severity MEDIUM is an analyst assignment; the source gives no rating. Related context, not part of this report: CERT-FR's REACTIV situation report CERTFR-2026-CTI-006 (2026-09-30) counted 99 reported violations since 1 August (67 confirmed) in French ministries and listed unpatched software, IDOR, weak or missing MFA, infostealer credential theft and subcontractor compromise as recurring causes.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1566 Phishing
- T1199 Trusted Relationship
- T1204.002 User Execution: Malicious File
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1213 Data from Information Repositories
- T1119 Automated Collection

## Sources

- [CERT-FR: Violations de donnees applicatives - Retour d'experience du CERT-FR (CERTFR-2026-CTI-008)](https://cert.cyber.gouv.fr/cti/CERTFR-2026-CTI-008/)
- [CERTFR-2026-CTI-008 (PDF)](https://cert.cyber.gouv.fr/uploads/CERTFR-2026-CTI-008.pdf)
- [CERT-FR: Exfiltration de donnees du secteur social - Retour d'experience (CERTFR-2024-CTI-009)](https://cert.cyber.gouv.fr/cti/CERTFR-2024-CTI-009/)
- [LeMagIT: Violations de donnees a repetition - l'Anssi fait son bilan et donne ses conseils](https://www.lemagit.fr/actualites/366652500/Violations-de-donnees-a-repetition-lAnssi-fait-son-bilan-et-donne-ses-conseils)
- [IT Social: Violations de donnees, la plupart des exfiltrations passent par des identifiants legitimes](https://itsocial.fr/cybersecurite/cybersecurite-articles/violations-de-donnees-la-plupart-des-exfiltrations-passent-par-des-identifiants-legitimes/)
- [Metametris: Fuites de donnees applicatives - Synthese du RETEX CERT-FR](https://www.metametris.com/articles/fuites-de-donnees-applicatives-synthese-du-retex-cert-fr)
- [Mallory: CERT-FR Issues Web Application Security Guidance After Tracking Nearly 200 Data Breaches](https://mallory.ai/stories/01a15940-e280-76fc-af69-e7deb1b9e78b)
- [Leto Legal: Faille Metabase - neuf instances ministerielles compromises, bilan REACTIV (related context, CERTFR-2026-CTI-006)](https://www.leto.legal/news/anssi-reactiv-faille-metabase-ministeres-2026)
- [CERT-FR: Panorama de la cybermenace 2025 (CERTFR-2026-CTI-002)](https://cert.cyber.gouv.fr/uploads/CERTFR-2026-CTI-002.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4191