CERT-FR details lessons from 200 web data breaches
CERT-FR shares 2025 lessons from nearly 200 web application data breaches, noting many exfiltrations required no technical vulnerability exploitation.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- Not tied to a specific actor, malware or CVE, only to the sectors it covers, so it may be general reporting. Check the source before acting on it. Whether it concerns you is not assessed.
CERT-FR published a lessons-learned (RETEX) report summarizing its experience responding to close to 200 data breach incidents affecting web applications in 2025. The report notes that in many cases, attackers achieved data exfiltration through low-complexity actions rather than exploiting technical vulnerabilities, highlighting that basic security hygiene and access control failures are a recurring root cause of breaches. This follows a 2024 CERT-FR report that was limited to the social services sector; this new document broadens scope to web applications handling sensitive data generally.
The report is explicitly not a comprehensive guide but a practical set of ten risk-reduction measures derived from real incident response engagements, intended to raise the baseline security level of existing systems rather than define a long-term ideal state. It is structured in two parts: a set of security principles, followed by technical annexes showing how to implement them across configurations commonly encountered by ANSSI during incident response. The document emphasizes concrete, short-to-medium-term mitigations rather than theoretical best practices.
For defenders, the key takeaway is that most of these ~200 breaches did not require sophisticated exploitation — meaning basic defensive measures (access controls, authentication hardening, logging, data minimization) would likely have prevented or limited many of them. Data disclosures are noted as having significant downstream impact on individuals, including enabling targeted fraud campaigns using precise personal information. Organizations operating web applications that process sensitive data should review the ten principles and technical annexes to assess their own exposure to similar low-complexity attack paths.
Source reporting: https://www.cert.ssi.gouv.fr/cti/CERTFR-2026-CTI-008
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs