Data leak at ANSSI, DINUM and Tracfin via a Metabase vulnerability

But who will guard these guardians? The French cybersecurity policeman had to register on his own list of victims. ANSSI lists 118 compromised accounts in its innovation laboratory, according to the situation update of operation REACTIV published on September 30.

She is not alone in the photo. The DINUM (interministerial digital department) and the anti-money laundering service Tracfin also appear there. The observation is enough to make one cringe three weeks after activation of REACTIV.

Data leak at ANSSI, the firefighter caught in the fire

The culprit is called Metabase. This statistical dashboard software suffers from a flaw referenced CVE-2026-72898 that attackers have been exploiting en masse since the beginning of August. The mechanism is disarmingly simple: a tricked request, slipped where the software expects a trivial entry, opens the database to a stranger and offers him administrator rights. Specialists talk about SQL injection.

The fix has been in existence since August 6. However, nine ministerial authorities have fallen, according to the ANSSI situation report.

At the agency's innovation laboratory, the Metabase vulnerability delivered 118 user accounts, including around thirty belonging to external parties. Identifiers, email addresses, hashed passwords (stored in scrambled form, in principle unreadable) and usage statistics are released. ANSSI has updated its authorities and renewed all passwords. She also deactivated accounts that had been dormant for more than three months.

DINUM suffered the same fate on two instances, ProConnect and Nuage-Public. The data provided (SIREN, budgets and staff of public organizations, anonymized connection histories) were already public, according to the report.

Tracfin, data leak by the subcontractor

At Tracfin, the entry point was not Metabase. A subcontractor of the operator who manages support for the online declaration portal was compromised between the end of June and mid-July. This portal is used by “subjects”, these professionals who are required by law to report suspicious transactions: banks, notaries, real estate agents and, since the 2019 Pacte law, crypto service providers.

Results for 136 subjects whose name, position, email and telephone number were leaked, with the content of 213 requests sent to technical support. No suspicious transaction report was made. The administration cut ties with the service provider.

The report slips in one more detail. Investigators are still looking for “potential other indirect victims” of this subcontractor, which leaves the counter open.

Crypto platforms have every reason to listen. They sent 4,850 suspicious transaction reports to Tracfin in 2025, an increase of 58% over one year. A compliance manager whose name, position and direct line are in circulation becomes a perfect target for a fake support scam, especially if the scammer can cite a real ticket.

99 violations in two months, data leak as routine

Since August 1, 99 data breaches have been reported to ANSSI. The agency has confirmed 67, of which 32 are being processed by its own teams.

The volumes are dizzying. The Zero Vacant Housing platform, whose entry point would also be a Metabase instance, would concern 48 million owners. The National Education GAIA file potentially exposes 4.35 million teachers, and Bloctel was closed on August 11 after a leak which identified around 600,000 registered numbers.

The causes are repeated from one ministry to another. ANSSI first points to infostealers (spyware that sucks up passwords saved on a computer), often housed on personal computers used for work. She also cites the absence of double authentication on services exposed to the Internet. A stolen password was enough.

Do you hold crypto and appear in one of these files? Be wary of any call that cites your taxes, housing, or records, and enable two-factor authentication wherever it exists.