Sophisticated Cyberattack Hits French Ministerial IT Cluster, Forcing Service Shutdowns
A French ministerial cluster shared across multiple government departments suffered a sophisticated cyberattack targeting its core messaging and collaboration infrastructure. The intrusion specifically compromised the Bureau numérique (`Bnum`), an internal workspace platform hosting ministerial email inboxes, employee calendars, and organizational directories. In response to the detected breach, the ministerial IT directorate launched in-depth investigations to determine the attackers' tactics, techniques, and procedures, as well as the overall scope of compromised systems. Incident responders immediately rolled out containment measures, forcing a mandatory password reset for all user accounts impacted by the breach. To limit further lateral movement and potential data exfiltration, the administration executed an emergency shutdown of the `Z-Push` service. This open-source ActiveSync engine, which allows government staff to sync mail and calendar items to mobile devices, remains suspended indefinitely. Network administrators also cut off external access to the `Bnum` platform from selected untrusted equipment and network segments while forensic analysis continues. The incident follows a previous attack against the `Bnum` platform last year, in which threat actors affiliated with the Lapsus group exfiltrated roughly 61 gigabytes of data from the Ministry of Agriculture. This disruption lands amidst an aggressive wave of intrusions targeting French public infrastructure throughout 2026, including notable breaches at the national tax administration and the education sector. French authorities have responded with a broader mandate requiring multi-factor authentication across all civil service accounts by the end of the year, alongside a policy requiring ministries to allocate at least 5% of their total IT budgets to cybersecurity starting in 2027.
Read more about Sophisticated Cyberattack Hits French Ministerial IT Cluster, Forcing Service Shutdowns