“Of the more than 825,000 registered agents, 73,467 agents would be affected by this incident, or less than 9% of registered users.”
DINUM: scope of the breach and initial response
France’s digital affairs directorate, DINUM, disclosed that a compromise of the Tchap instant messaging service affected 73,467 public-sector accounts — roughly 9% of the platform’s registered users. DINUM said it notified the country’s data protection authority, the CNIL, and that investigators identified and immediately blocked the account used to make the malicious requests. In its public update DINUM emphasized that private conversations remained protected by encryption while data in public chat rooms had been exposed.
What was exposed: public rooms, user metadata and shared files
DINUM said the attacker was able to steal content from Tchap’s public chat rooms, which are not encrypted by design. According to the directorate, “Potentially exposed data from user accounts concerns at least: last name, first name, email address, belonging entity and avatar.” The threat actor who claimed responsibility produced a sample of stolen material and said they had scraped nearly 650,000 messages and information from more than 73,000 accounts, including email addresses, meeting links, organisation information, and account and device metadata. The actor also claimed to have taken over 13.5 GB of documents and media files shared via the service and to have recovered hardcoded LDAP credentials that had been leaked inside a PowerShell script.
Threat actor claims and the apparent method
DINUM has not attributed the intrusion publicly, but a threat actor posted a claim over the weekend and provided samples. The actor said they gained access following a social engineering attack and that they had scraped messages, account details and files. DINUM confirmed the attack began from a compromised user account that allowed the actor to access public-room data, and said the account used for the malicious requests had been identified and blocked to remove persistent access and allow in‑depth analysis.
Tchap’s origin, design and recent deployment
Tchap was developed by DINUM together with ANSSI, the French cybersecurity agency, and is built on the Matrix protocol. The service was rolled out as the default work communications app for civil servants in early August 2025. Since then, DINUM says Tchap has reached over 300,000 monthly users and has passed 500,000 downloads on Google’s Play Store.
What this means for technologists, policymakers, and public servants
- Technologists and security teams: expect focused scrutiny on how public, non‑encrypted channels are handled and how a single compromised account can be used to harvest metadata and files from open forums.
- Policymakers and regulators: CNIL has been notified; regulators will watch the scope of exposed personal data — names, emails, employer details and avatars — and any follow‑up disclosures about the stolen documents and credentials.
- Public servants and platform users: DINUM’s update distinguishes encrypted private conversations from public-room posts; users whose names and emails appear in public forums should assume those elements were accessible to the attacker.
DINUM’s public timeline shows three immediate actions: identification of the malicious account, its removal, and a commitment to an in-depth forensic analysis. The actor’s public claims — scraped messages, 13.5 GB of files, and leaked LDAP credentials inside a PowerShell script — raise further questions about what confidential material may have been available in public rooms and how such credentials were stored.
One related item in recent reporting: in May authorities arrested a 15‑year‑old suspected of selling data stolen in an April attack on ANTS, the agency that issues official identity and registration documents. That incident was separate from the Tchap disclosure; DINUM has not linked the two in its statements.
For now, DINUM’s confirmation that private conversations remained encrypted frames the immediate risk as a metadata and public‑room content exposure affecting 73,467 agents out of more than 825,000 registered users. The principal unresolved facts are who is behind the intrusion and what proportion of the claimed 13.5 GB of files are sensitive. DINUM’s blocking of the malicious account and the CNIL notification are the concrete steps reported so far; forensic findings and any formal attribution remain to be published.
Source: BleepingComputer — Over 73,000 French govt employees affected in Tchap messenger breach
