ANSSI issues second REACTIV situation update
CERT-FR's October 2026 update on operation REACTIV details ANSSI's enhanced response to data breaches and account compromises hitting French state services.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This is CERT-FR's second status report on operation REACTIV, a cyberdefense initiative launched after the French Prime Minister directed ANSSI on 1 September 2026 to establish reinforced incident response capability for state services facing intensifying cybercriminal attacks tied to data breaches. REACTIV (Réponse & Action Interministérielle face aux Violations de données) allows ANSSI to immediately mobilize resources alongside affected ministries to handle compromised user accounts and analyze data breaches, aiming to better contain attacks and respond more reactively to data exfiltration.
The operation grants ANSSI expanded authority, including the ability to compel ministries to take urgent protective measures within constrained deadlines to safeguard citizens' data, and centralized technical crisis communication in the event of an attack related to this threat affecting state services. This complements the broader 2026-2027 Roadmap of priority digital security efforts for the State, whose implementation the Prime Minister has asked to accelerate to durably raise security levels across ministerial networks.
The report explicitly notes it reflects ongoing investigations and evolving incidents, so figures and details are subject to change and do not represent a fully exhaustive picture of the operational situation regarding data breaches affecting the French state at any given time. No specific threat actors, malware, CVEs, or IOCs are disclosed in this situational update; it is primarily an administrative/operational briefing on France's governmental incident response posture.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/cti/CERTFR-2026-CTI-010
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs