The French government confirmed that unauthorized entry into its Tchap secure messaging service has impacted accounts belonging to more than 73,000 public sector workers.

DINUM, the nation's digital affairs agency, stated on Monday that an intruder obtained entry via a stolen user credential and alerted the CNIL data protection body about possible exposure of personal details shared by certain participants.

Although few specifics emerged at first regarding the scope or nature of the incident, DINUM later clarified that the intruder potentially viewed content from roughly nine percent of all registered accounts on the service.

The agency noted that private exchanges stay encrypted and shielded, yet the intruder extracted material posted in open discussion areas that lack encryption. This yielded names, email addresses, profile images, and the public organizations tied to each user.

Of more than 825,000 registered staff, 73,467 accounts appear involved in the event, representing under nine percent of total users. These open forums allow access to everyone by design and carry no encryption. Private staff exchanges stay secure, the agency added.

The account used for the unauthorized requests has now been located and blocked at once to end further access and permit full review of what was reached. Exposed account details include at minimum last name, first name, email address, affiliated entity, and avatar image.

DINUM has not yet identified the source of the intrusion, though a threat group asserted responsibility over the weekend and released a portion of taken files, stating entry came through a social engineering effort.

The group said it gathered nearly 650,000 messages along with details from over 73,000 accounts, covering email addresses, meeting links, organization data, and account plus device metadata.

The intruders also reportedly obtained more than 13.5 GB of documents and media files exchanged by civil servants on Tchap, plus hardcoded LDAP credentials disclosed through a PowerShell script.

Created by DINUM together with ANSSI in 2018, Tchap serves as a decentralized collaboration and messaging tool for the French public sector and relies on the Matrix protocol.

After it became the standard tool for official communications among all civil servants in early August 2025, Tchap now serves over 300,000 monthly users and exceeds 500,000 downloads on the Google Play Store.

In May, French officials detained a 15-year-old suspected of selling information taken during an April cyber incident at ANTS, the national agency handling secure identity and registration documents.