# CERT-FR details lessons from 200 web data breaches

Published: 2026-10-20 · Severity: routine · Sectors: Government (National) · Not tied to an actor or CVE
Canonical: https://vorant.io/reports/2b0cd343-3f81-57b9-b155-5f156ff31bd3/cert-fr-details-lessons-from-200-web-data-breaches
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR shares 2025 lessons from nearly 200 web application data breaches, noting many exfiltrations required no technical vulnerability exploitation.

Source: cert.ssi.gouv.fr — https://www.cert.ssi.gouv.fr/cti/CERTFR-2026-CTI-008

## What to check

- Applies to: Not tied to a specific actor, malware or CVE, only to the sectors it covers, so it may be general reporting. Check the source before acting on it. Whether it concerns you is not assessed.

CERT-FR published a lessons-learned (RETEX) report summarizing its experience responding to close to 200 data breach incidents affecting web applications in 2025. The report notes that in many cases, attackers achieved data exfiltration through low-complexity actions rather than exploiting technical vulnerabilities, highlighting that basic security hygiene and access control failures are a recurring root cause of breaches. This follows a 2024 CERT-FR report that was limited to the social services sector; this new document broadens scope to web applications handling sensitive data generally.

The report is explicitly not a comprehensive guide but a practical set of ten risk-reduction measures derived from real incident response engagements, intended to raise the baseline security level of existing systems rather than define a long-term ideal state. It is structured in two parts: a set of security principles, followed by technical annexes showing how to implement them across configurations commonly encountered by ANSSI during incident response. The document emphasizes concrete, short-to-medium-term mitigations rather than theoretical best practices.

For defenders, the key takeaway is that most of these ~200 breaches did not require sophisticated exploitation — meaning basic defensive measures (access controls, authentication hardening, logging, data minimization) would likely have prevented or limited many of them. Data disclosures are noted as having significant downstream impact on individuals, including enabling targeted fraud campaigns using precise personal information. Organizations operating web applications that process sensitive data should review the ten principles and technical annexes to assess their own exposure to similar low-complexity attack paths.

Source reporting: https://www.cert.ssi.gouv.fr/cti/CERTFR-2026-CTI-008

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2b0cd343-3f81-57b9-b155-5f156ff31bd3/cert-fr-details-lessons-from-200-web-data-breaches.
The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup