France's Direction interministérielle du numérique (DINUM) has confirmed a breach of Tchap, the state's sovereign, Matrix-based messaging platform, after an attacker took over a single legitimate user account and used that valid session to harvest data across the platform's public rooms. DINUM puts the confirmed impact at 73,467 affected accounts out of more than 825,000 registered public-sector users, which the agency framed to AEF info as "moins de 9 % des utilisateurs inscrits." A threat actor using the handle "Misère" claims a far larger haul: roughly 13.5 GB spanning hundreds of thousands of messages, tens of thousands of files, and references to restricted-distribution material. DINUM has not confirmed those claims. The Paris prosecutor has handed the criminal investigation to the Ofac, and CNIL has been notified.
What Happened
The core facts are consistent across sources: this was an account takeover, not a break in Matrix or in Tchap's cryptography. DINUM described the entry point as an "usurpation de compte," the hijacking of a standard user's legitimate credentials, which handed the attacker an authenticated session with the same visibility any civil servant would have.
Dates in the reporting are messy and worth stating plainly. TNW and Karsane both place ANSSI's detection on June 7, 2026, with DINUM publishing its incident notice and blocking the account shortly after. Sysdig and the French-language Tech Insider piece date the public confirmation by DINUM and ANSSI to June 8, 2026. Tech Insider's English article contains a garbled timeline referencing "May 4, 2025" alongside June 8, which does not reconcile with any other source and should be treated as an error rather than a competing account. The workable reading is detection on or around June 7 and public disclosure on June 8, with the attacker's own claimed access window stretching from June 2023 to June 2026 based on the age of the content they say they pulled.
DarkOwl, summarising BleepingComputer, notes ANSSI detected the compromise on a Sunday, which is consistent with June 7, 2026. Investigators were still working through logs weeks after disclosure to establish which rooms were reached and what actually left the platform.
What Was Taken
There are two competing damage assessments, and they are far apart.
The government's number is the narrow one. DINUM confirmed 73,467 affected accounts. SSH's technical write-up details the exposed field set as names, email addresses, employing organisations, and avatar images, all of it sitting outside the encryption boundary in public, unencrypted rooms that any authenticated Tchap user can find and join. DINUM's consistent line, reported by TNW and SSH alike, is that end-to-end encrypted private conversation history remained inaccessible even to an impersonated account.
The attacker's number is the broad one. "Misère" claims data tied to roughly 73,000 state agents plus 643,000 messages (TNW and Tech Insider FR), which AEF info renders as "près de 650 000 messages" citing the prosecutor's account; nearly 60,000 files totalling about 13.5 GB; hundreds of chat rooms; and around 90 items referencing "Diffusion Restreinte," France's restricted-distribution marking. Sysdig's June briefing repeats the 13.5 GB figure and describes the exposure as email addresses and organisational details from more than 73,000 accounts.
The denominator also varies. Most sources, including AEF info quoting DINUM directly, SSH, and Tech Insider, use "more than 825,000" registered agents. Sysdig alone says 600,000 user accounts. Given DINUM's own "less than 9 percent" framing only works against the larger figure, 825,000+ is the number to carry.
One further escalation comes from the criminal filing rather than the attacker: AEF info reports DINUM's complaint denounced "l'exportation de conversations, revendues sur le darknet," meaning the government itself alleges exfiltrated conversations were resold. That is a materially stronger claim than DINUM's public "may have been viewed" language and sits uncomfortably alongside it.
Why It Matters
Tchap is not just another messenger. France banned foreign apps including Signal and WhatsApp for public-sector communications and pushed civil servants onto Tchap on sovereignty grounds. It is the flagship government deployment of Matrix, the protocol a growing list of European administrations have adopted precisely to escape dependence on American cloud platforms. A breach notice attached to that name is a political event as much as a security one.
The defensive lesson, argued most directly by SSH, is that the encryption did its job and the breach happened anyway. Private end-to-end encrypted rooms held. What leaked was directory-grade identity data and public-room content that was never encrypted by design. Encryption is one layer of a communications security model that also includes identity, access control, room structure, permissions, and the discoverability defaults of the platform.
The downstream risk is social engineering. A validated roster of tens of thousands of civil servants with names, work emails, and employing ministries is high-grade targeting material for phishing and impersonation against the French state, a point Sysdig flags explicitly. AEF info separately cites a French intelligence services note warning of a surge in attack campaigns against instant-messaging accounts specifically in sovereign sectors. Tech Insider FR reports that CERT-EU logged a wave of targeting against public institutions in at least five European countries in the same month, which we note as a single-source claim rather than a confirmed link to this incident.
The Attack Technique
Nothing exotic. Accounts differ on the precise mechanism of credential capture.
TNW reports the attacker says entry came through social-engineering an account on Tchap's education environment. DarkOwl, citing BleepingComputer, reports the actor claimed they obtained leaked LDAP credentials and used social engineering to convert that into access. Karsane, also citing BleepingComputer, describes ANSSI detecting that a valid user account had been hijacked through social engineering. These are compatible with each other, and DINUM's public framing does not confirm any of them beyond the account-takeover characterisation.
The exploitation path afterwards is the important part. A valid session on a Matrix-based platform is not a foothold that needs escalation. It is membership. Public rooms are visible and joinable to any authenticated user, so a single compromised identity yields breadth immediately, without malware, lateral movement, or a software vulnerability. Sysdig's assessment is that the root cause was likely human error. Detection came from anomalous request volume flagged by security monitoring, and containment was blocking the account, which cut persistent access.
What Organizations Should Do
- Enforce phishing-resistant MFA on collaboration platforms. Password-plus-OTP does not stop the social-engineering and credential-replay path used here. FIDO2 or certificate-based authentication on every account, including low-privilege standard users, since a standard user was the entry point.
- Treat public channels as published data. Audit what actually sits in open rooms: attachments, directory data, meeting notes, document references. DINUM's own post-incident guidance to users was a reminder that public rooms are not the place for sensitive material. Enforce that with retention limits and attachment policy, not reminders.
- Restrict directory and room discoverability. Default-visible member lists and open-join rooms convert one compromised account into an org-wide harvest. Segment rooms by department or clearance and require approval to join anything sensitive.
- Alert on session-level behavioural anomalies. The detection signal here was abnormal request patterns from a legitimate account. Build baselines for room joins per hour, message-history pulls, and bulk media downloads, and alert on deviations rather than on failed logins.
- Watch federated and secondary environments. The reported entry through an education-tier environment shows the weakest-governed tenant sets the security floor for the whole federation. Inventory every environment bridged into your primary deployment and apply uniform identity controls.
- Pre-plan the disclosure and forensics path. DINUM notified CNIL, coordinated with ANSSI, filed a criminal complaint, and was still reconstructing scope from logs weeks later. Verify your logging retains enough room-level and session-level detail to answer "what did this account actually read" months after the fact.
Sources: Tchap Breach: 73,467 French Govt Accounts Hit 2026 | France’s ‘sovereign’ messenger Tchap was breached, and officials an... | The Tchap Breach: An Architecture Lesson SSH | Compromission de Tchap : moins de 9 % des utilisateurs seraient con... | Security briefing: June 2026 Sysdig | Threat Intelligence Round Up: June DarkOwl | Tchap France Government Hack 2026: 73,000 Accounts Exposed - Karsane | Piratage de Tchap : 73 467 Comptes Exposés 2026