Attacker gets into France's database listing all bank accounts, makes off with 1.2 million records
(2026/02/23)
- Reference: 1771802810
- News link: https://www.theregister.co.uk/2026/02/22/french_bank_hack/
- Source link:
Infosec In Brief An unknown attacker accessed the French government’s database listing every bank account in the country and made off with 1.2 million records.
France’s Ministry of Economics, Finance and Industrial and Digital Sovereignty last week [1]revealed the incident took place in January, after unknown attackers used stolen credentials to access the database.
The Ministry said the attacker's access was restricted immediately upon discovery of the attack, but that the miscreant still managed to access personal information about 1.2 million accounts, including account numbers, account holder’s addresses, and tax identification numbers.
[2]
France’s government has mobilized the agencies that fight this sort of incident, and warned account holders to be on the lookout for suspicious messages.
0days in Ivanti's EPMM under attack
Palo Alto Networks' Unit 42 reported last week that the pair of [3]zero-days in Ivanti Endpoint Manager for Mobile (EPMM) that the vendor patched last month are proving popular with attackers.
[4]According to Unit 42 researchers, cyber-scum are aware of the two 9.8-rated CVEs – [5]CVE-2026-1281 and [6]CVE-2026-1340 – and are targeting unpatched systems.
[7]
[8]
State and local governments, healthcare, manufacturing, professional and legal services, and the tech sector in the US, Germany, Australia, and Canada have all been peppered by attackers leveraging those vulnerabilities.
Unit 42 reports that attackers have tried to exploit them by establishing a reverse shell, installing web shells, downloading malware, and conducting reconnaissance in a search for further vulnerabilities.
[9]
The researchers noted that patches are available for both vulnerabilities and point out that installation doesn’t require downtime, so deserves a prominent place on owners’ to-do lists.
0APT a hoax? Not so fast, say researchers
You may recall in last week's security roundup that we wrote about GuidePoint Security’s opinion that a group calling itself [10]0APT appears to be a fake gang using other cybercriminals' ill-gotten data to pass off as their own.
Researchers with security firm Cyderes' Howler Cell threat research team reached out to warn us not to ignore the group, as there are signs it's a real threat.
According to Howler Cell's [11]research , 0APT's initial presence might be mostly fake, but "the operators behind 0APT are running an active Ransomware-as-a-service platform with functional malicious payloads and a working affiliate model."
Howler Cell warns that the bluff may have been an attempt to attract attention, like we said, but not just to scam victims – they may also be trying to attract affiliates by making quick reputation gains.
[12]
Howler Cell said that it managed to access the group's ransomware-as-a-service portal, collecting malware samples that were fully viable and just waiting to be deployed.
"The 0APT ransomware demonstrates a clear focus on reliability, operator configurability, and secure cryptographic implementation, aligning with modern trends in Rust‑based ransomware development," Howler Cell said.
You've been warned.
[13]Infosec exec sold eight zero-day exploit kits to Russia, says DoJ
[14]Telcos aren't saying how they fought back against China's Salt Typhoon attacks
[15]Open-source AI is a global security nightmare waiting to happen, say researchers
[16]Pwn2Own Automotive 2026 uncovers 76 zero-days, pays out more than $1M
AI helps cybercrims move faster, do more
AI is rapidly becoming a cybercriminal's best friend, serving as a force multiplier that is increasing attacker success rates at each stage of a campaign.
Unit 42 said in its 2026 Global Incident Response [17]Report published last week that AI contributed to a quadrupling of exfiltration speeds in 2025, making it one of the most dangerous emerging threats for the coming year.
"AI is changing the economics of intrusions," Unit 42 said in the report. "It increases attacker speed, scale and effectiveness while opening entirely new attack vectors."
We've known that AI has [18]helped [19]cybercriminals for a while. Unit 42's report, however, suggests whatever trends we've seen to date are only going to accelerate and make the problem worse.
AI is enabling attackers to move faster to exploit vulnerabilities, with Unit 42 saying it has seen signs that attackers are using AI to help them scan for exposed vulnerabilities within 15 minutes of a CVE being announced.
"Exploitation attempts often begin before many security teams have even finished reading the vulnerability advisory," Unit 42 noted. AI assistance has meant that time-to-exfiltration can be as little as 25 minutes, according to Unit 42's simulations.
AI is further lowering the barrier to entry for new attackers too, by making it easy to personalize social engineering exploits and keeping them free of the spelling and grammar errors that betray their nature.
Constant vigilance and a new line of defenses will be needed to keep up with this latest generation of AI threats, tips for which are included in the Unit 42 report.
Tenga leaks customer details
Sex toy manufacturer Tenga said a "limited segment" of its US customer base who interacted with company support reps have had their details spilled.
Cybercriminals obtained correspondence history and customer email addresses (no other PII or financial information, but even that limited bit of data could get embarrassing) by probing a single employee's email account, the company [20]said .
It seems a malicious email campaign may also be involved using the addresses obtained by the digi-crook, as Tenga is also warning customers caught in the leak not to open suspicious attachments.
The company said it's already been in touch with affected customers, and said it intends to use more protection to prevent another such incident in the future. ®
Get our [21]Tech Resources
[1] https://presse.economie.gouv.fr/acces-illegitimes-au-fichier-national-des-comptes-bancaires-ficoba/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aZve9FhzYlAHtEM-pbSv7AAAAEg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2026/01/30/ivanti_epmm_zero_days/
[4] https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-1281
[6] https://nvd.nist.gov/vuln/detail/CVE-2026-1340
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZve9FhzYlAHtEM-pbSv7AAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZve9FhzYlAHtEM-pbSv7AAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZve9FhzYlAHtEM-pbSv7AAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2026/02/15/exl3harris_exec_sold_8_zeroday/
[11] https://www.cyderes.com/howler-cell/0apt-bluff-campaign-evolves-into-potential-threat
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZve9FhzYlAHtEM-pbSv7AAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2026/02/15/exl3harris_exec_sold_8_zeroday/
[14] https://www.theregister.com/2026/02/08/infosec_news_in_brief/
[15] https://www.theregister.com/2026/02/01/opensource_ai_is_a_global/
[16] https://www.theregister.com/2026/01/25/pwn2own_automotive_2026_identifies_76_0days/
[17] https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report
[18] https://www.theregister.com/2026/01/20/group_ib_ai_cycercrime_subscriptions/
[19] https://www.theregister.com/2025/09/03/ransomware_ai_abuse/
[20] https://www.tenga.co/topics/17025/
[21] https://whitepapers.theregister.com/
France’s Ministry of Economics, Finance and Industrial and Digital Sovereignty last week [1]revealed the incident took place in January, after unknown attackers used stolen credentials to access the database.
The Ministry said the attacker's access was restricted immediately upon discovery of the attack, but that the miscreant still managed to access personal information about 1.2 million accounts, including account numbers, account holder’s addresses, and tax identification numbers.
[2]
France’s government has mobilized the agencies that fight this sort of incident, and warned account holders to be on the lookout for suspicious messages.
0days in Ivanti's EPMM under attack
Palo Alto Networks' Unit 42 reported last week that the pair of [3]zero-days in Ivanti Endpoint Manager for Mobile (EPMM) that the vendor patched last month are proving popular with attackers.
[4]According to Unit 42 researchers, cyber-scum are aware of the two 9.8-rated CVEs – [5]CVE-2026-1281 and [6]CVE-2026-1340 – and are targeting unpatched systems.
[7]
[8]
State and local governments, healthcare, manufacturing, professional and legal services, and the tech sector in the US, Germany, Australia, and Canada have all been peppered by attackers leveraging those vulnerabilities.
Unit 42 reports that attackers have tried to exploit them by establishing a reverse shell, installing web shells, downloading malware, and conducting reconnaissance in a search for further vulnerabilities.
[9]
The researchers noted that patches are available for both vulnerabilities and point out that installation doesn’t require downtime, so deserves a prominent place on owners’ to-do lists.
0APT a hoax? Not so fast, say researchers
You may recall in last week's security roundup that we wrote about GuidePoint Security’s opinion that a group calling itself [10]0APT appears to be a fake gang using other cybercriminals' ill-gotten data to pass off as their own.
Researchers with security firm Cyderes' Howler Cell threat research team reached out to warn us not to ignore the group, as there are signs it's a real threat.
According to Howler Cell's [11]research , 0APT's initial presence might be mostly fake, but "the operators behind 0APT are running an active Ransomware-as-a-service platform with functional malicious payloads and a working affiliate model."
Howler Cell warns that the bluff may have been an attempt to attract attention, like we said, but not just to scam victims – they may also be trying to attract affiliates by making quick reputation gains.
[12]
Howler Cell said that it managed to access the group's ransomware-as-a-service portal, collecting malware samples that were fully viable and just waiting to be deployed.
"The 0APT ransomware demonstrates a clear focus on reliability, operator configurability, and secure cryptographic implementation, aligning with modern trends in Rust‑based ransomware development," Howler Cell said.
You've been warned.
[13]Infosec exec sold eight zero-day exploit kits to Russia, says DoJ
[14]Telcos aren't saying how they fought back against China's Salt Typhoon attacks
[15]Open-source AI is a global security nightmare waiting to happen, say researchers
[16]Pwn2Own Automotive 2026 uncovers 76 zero-days, pays out more than $1M
AI helps cybercrims move faster, do more
AI is rapidly becoming a cybercriminal's best friend, serving as a force multiplier that is increasing attacker success rates at each stage of a campaign.
Unit 42 said in its 2026 Global Incident Response [17]Report published last week that AI contributed to a quadrupling of exfiltration speeds in 2025, making it one of the most dangerous emerging threats for the coming year.
"AI is changing the economics of intrusions," Unit 42 said in the report. "It increases attacker speed, scale and effectiveness while opening entirely new attack vectors."
We've known that AI has [18]helped [19]cybercriminals for a while. Unit 42's report, however, suggests whatever trends we've seen to date are only going to accelerate and make the problem worse.
AI is enabling attackers to move faster to exploit vulnerabilities, with Unit 42 saying it has seen signs that attackers are using AI to help them scan for exposed vulnerabilities within 15 minutes of a CVE being announced.
"Exploitation attempts often begin before many security teams have even finished reading the vulnerability advisory," Unit 42 noted. AI assistance has meant that time-to-exfiltration can be as little as 25 minutes, according to Unit 42's simulations.
AI is further lowering the barrier to entry for new attackers too, by making it easy to personalize social engineering exploits and keeping them free of the spelling and grammar errors that betray their nature.
Constant vigilance and a new line of defenses will be needed to keep up with this latest generation of AI threats, tips for which are included in the Unit 42 report.
Tenga leaks customer details
Sex toy manufacturer Tenga said a "limited segment" of its US customer base who interacted with company support reps have had their details spilled.
Cybercriminals obtained correspondence history and customer email addresses (no other PII or financial information, but even that limited bit of data could get embarrassing) by probing a single employee's email account, the company [20]said .
It seems a malicious email campaign may also be involved using the addresses obtained by the digi-crook, as Tenga is also warning customers caught in the leak not to open suspicious attachments.
The company said it's already been in touch with affected customers, and said it intends to use more protection to prevent another such incident in the future. ®
Get our [21]Tech Resources
[1] https://presse.economie.gouv.fr/acces-illegitimes-au-fichier-national-des-comptes-bancaires-ficoba/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aZve9FhzYlAHtEM-pbSv7AAAAEg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2026/01/30/ivanti_epmm_zero_days/
[4] https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-1281
[6] https://nvd.nist.gov/vuln/detail/CVE-2026-1340
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZve9FhzYlAHtEM-pbSv7AAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZve9FhzYlAHtEM-pbSv7AAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZve9FhzYlAHtEM-pbSv7AAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2026/02/15/exl3harris_exec_sold_8_zeroday/
[11] https://www.cyderes.com/howler-cell/0apt-bluff-campaign-evolves-into-potential-threat
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZve9FhzYlAHtEM-pbSv7AAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2026/02/15/exl3harris_exec_sold_8_zeroday/
[14] https://www.theregister.com/2026/02/08/infosec_news_in_brief/
[15] https://www.theregister.com/2026/02/01/opensource_ai_is_a_global/
[16] https://www.theregister.com/2026/01/25/pwn2own_automotive_2026_identifies_76_0days/
[17] https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report
[18] https://www.theregister.com/2026/01/20/group_ib_ai_cycercrime_subscriptions/
[19] https://www.theregister.com/2025/09/03/ransomware_ai_abuse/
[20] https://www.tenga.co/topics/17025/
[21] https://whitepapers.theregister.com/
Anonymous Coward
Yeah, Tenga got a few [1]awards for its products, but its website (linked at 'company said' in TFA) uses [2]polyfill.io , so please don't go there without protection (eg. some sort of NoScript) ... ;)
[1] https://en.wikipedia.org/wiki/Tenga_(company)#Awards
[2] https://www.theregister.com/2024/06/25/polyfillio_china_crisis/
Good Advice from Tenga
An_Old_Dog
"...use more protection."
Down with...
Pen-y-gors
"France’s government has mobilized the agencies that fight this sort of incident,"
I can see Father Dougal now, standing outside the Elysée, with a sign saying "Down with this sort of incident"
Surprise!
VicMortimer
And does anybody wonder why governments should not be allowed to collect this sort of info yet?
Is it just me...
Brave Coward
... or all this Internet thing is happily heading towards an abject failure ?
Re: Is it just me...
ecofeco
It failed in 2001. But nobody seemed to notice.
Of course French govt need to collect details of every bank account
that one in the corner
One database to rule them all
One Join to find them,
One Select to bring them all and exfiltrate to bind them
Re: Of course French govt need to collect details of every bank account
Anonymous Coward
... and one highly visible [1]whiteboard to group usernames and passwords for system access ... !
[1] https://www.theregister.com/2026/02/19/human_whiteboard_bork/
Anonymous Coward
No worries, mates. Politicians have promised they can identify every Internet user and age gate the entire Internet without putting personally identifiable information at risk.
Move along, nothing to see here.
Go back to the future.
Tron
Your intranet, infrastructure, and as much of your computing as you can should never connect to the public internet. No SaaS, no cloud, no AI. Use separate systems for anything online.
Use simple, generic software packages to support your work, and use paper when it is safer, cheaper, or easier.
Data is a risk not an asset, so hold as little as you can, and keep it offline. Or switch to distributed systems, so you don't have a honeypot of data, attracting crims.
Or it will be a matter of time before you get turned over. Complex, large, bug-ridden and online systems cannot be secured.
I’m safe
Anonymous Coward
I rented a billboard at a major motorway intersection. It displays all of my PI.
So far, it’s been safer than your average online “security”.
Surely “suspicious attachments” is Tenga’s core business?