On June 7, 2026, France's government messaging platform Tchap was breached through the compromise of a single user account via social engineering targeting the education shard. The attacker accessed public chat rooms, which are unencrypted by design, and extracted a large volume of messages, user data, and files. Private rooms, protected by end-to-end encryption, were not accessed. The attacker also claimed to have found hardcoded LDAP credentials in a leaked PowerShell script. The French cybersecurity agency ANSSI detected the intrusion, and the compromised account was immediately blocked. The breach exposed personal data such as names, emails, affiliated entities, and avatars of government civil servants. The French Digital Affairs Directorate (DINUM) emphasized that sensitive information should not be shared in public rooms and notified the data protection authority CNIL. The incident underscores the security challenges of mandatory use of Tchap for civil servants without comprehensive security reassessment.

The breach resulted in unauthorized access to public chat messages, personal data of over 73,000 government users including email addresses and device metadata, and a large volume of documents and media files. Private conversations remained secure due to end-to-end encryption. The exposure of personal and professional information from public channels could lead to privacy violations and potential targeted attacks against affected individuals. The compromise of LDAP credentials in a leaked script may pose additional risks if leveraged. The incident affects the confidentiality of public communications on the platform but does not indicate compromise of private communications or the platform's core infrastructure.

The compromised account was identified and immediately blocked to prevent further unauthorized access. Users were reminded by DINUM that no personal, sensitive, or confidential information should be shared in public chat rooms, which are unencrypted by design. The French data protection authority CNIL was notified. No technical exploit or platform vulnerability was reported; the breach resulted from social engineering and stolen credentials. Organizations using Tchap should reinforce user awareness about social engineering risks and proper use of public versus private rooms. Patch status is not applicable as this was an account compromise, not a software vulnerability.