NewsPublished 10 Jun 2026

France’s Government Messaging App Tchap Got Breached

Source Reddit Cybersecurity

Discussion

France's government messaging app Tchap was breached after a single user account was compromised via social engineering. The attacker accessed public channels, scraping approximately 650,000 messages, data on over 73,000 accounts including email addresses and device metadata, and 13.5GB of documents and media. Private conversations remained protected by end-to-end encryption and were not accessed. The compromised account was quickly identified and blocked by French authorities. The breach highlights risks from mandatory adoption of the platform without proportional security review. The investigation is ongoing.

r/cybersecurity (opens in a new tab)u/sunychoudhary0 points0 comments

https://securityaffairs.com/193393/security/frances-government-messaging-app-tchap-got-breached.html

Links cited in the discussion

https://securityaffairs.com/193393/security/frances-government-messaging-app-tchap-got-breached.html

Impact

The breach resulted in unauthorized access to public chat messages, personal data of over 73,000 government users including email addresses and device metadata, and a large volume of documents and media files. Private conversations remained secure due to end-to-end encryption. The exposure of personal and professional information from public channels could lead to privacy violations and potential targeted attacks against affected individuals. The compromise of LDAP credentials in a leaked script may pose additional risks if leveraged. The incident affects the confidentiality of public communications on the platform but does not indicate compromise of private communications or the platform's core infrastructure.

Defensive guidance

The compromised account was identified and immediately blocked to prevent further unauthorized access. Users were reminded by DINUM that no personal, sensitive, or confidential information should be shared in public chat rooms, which are unencrypted by design. The French data protection authority CNIL was notified. No technical exploit or platform vulnerability was reported; the breach resulted from social engineering and stolen credentials. Organizations using Tchap should reinforce user awareness about social engineering risks and proper use of public versus private rooms. Patch status is not applicable as this was an account compromise, not a software vulnerability.

Summary

On June 7, 2026, France's government messaging platform Tchap was breached through the compromise of a single user account via social engineering targeting the education shard. The attacker accessed public chat rooms, which are unencrypted by design, and extracted a large volume of messages, user data, and files. Private rooms, protected by end-to-end encryption, were not accessed. The attacker also claimed to have found hardcoded LDAP credentials in a leaked PowerShell script. The French cybersecurity agency ANSSI detected the intrusion, and the compromised account was immediately blocked. The breach exposed personal data such as names, emails, affiliated entities, and avatars of government civil servants. The French Digital Affairs Directorate (DINUM) emphasized that sensitive information should not be shared in public rooms and notified the data protection authority CNIL. The incident underscores the security challenges of mandatory use of Tchap for civil servants without comprehensive security reassessment.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 10 Jun 2026, 10:25 UTC

Technical details

References

Community reviews

Related threats