French Government Messenger Tchap Breached: 14GB Stolen

2 Minutes

Tchap, the messaging app used inside the French administration, has been breached. Short sentence. Big alarm.

France's national cybersecurity agency, ANSSI, detected the intrusion on June 7 and DINUM, the government's digital affairs office, opened an immediate investigation to trace the scope of the compromise. Officials say the attacker account has been identified and blocked, but forensic work is still underway to establish exactly what was taken.

Built on the Matrix protocol and deployed for exclusive use by civil servants since 2019, Tchap was designed to be an internal, encrypted alternative to mainstream platforms. That intent did not prevent an adversary from gaining a foothold. The attackers claim to have exfiltrated roughly 14 gigabytes of documents and work files shared by government employees.

The haul reportedly includes email addresses, meeting links and internal organizational information. Those items may seem mundane on paper. In practice, they are the keys to follow-up intrusions: phishing, meeting disruptions, or deeper lateral moves inside government networks. Small pieces of metadata can become a map for larger operations.

All of this arrives while Paris is actively reducing its reliance on foreign software. The government has moved many endpoints to Linux and is pushing native replacements for services such as Zoom and Microsoft Teams. Yet changing the operating system and swapping tools does not magically erase risk. Secure infrastructure needs rigorous operational controls, not just a new label.

ANSSI and DINUM now face two tasks: contain any remaining access and determine the full extent of data exposure. This is forensic work. It is also a credibility test for an administration that has foregrounded digital sovereignty as policy.

This incident is a clear reminder that building homegrown systems is only one step; maintaining them against targeted attacks is another.

Expect more details as investigators parse servers, logs and cryptographic artifacts. For now, the breach raises a quiet but urgent question: how do you trust a system you run yourself? Watch this space as answers start to surface.