French Prime Minister Sébastien Lecornu has acknowledged that “few ministries are at the required level” of cybersecurity and ordered the creation of a new dedicated cyber unit after successive breaches hit the tax authority and the education ministry.
In a letter dated August 19 addressed to the secretary-general for defence and national security, Nicolas Roche, Lecornu wrote that there is “urgency to design and conduct without delay a more reactive and stronger operational response to the cyberattacks that the State is currently encountering. We must regain the initiative on the ground.”
He directed the National Agency for the Security of Information Systems (ANSSI) to form a contact team of its agents “charged with intervening on the front line in the event of suspicion of a serious attack on the integrity of the State’s information system.”
A detailed proposal for the unit’s organisation, rules of engagement, resources and leadership is required by August 21. Lecornu asked Roche for an organisation chart, a budget and the name of the official who will command the team.
The unit is intended to act upstream of crises (from the moment sensitive access is compromised), during incidents and afterwards, delivering systematic post-action analysis. It may be reinforced as needed by specialists from the armed forces and interior ministry.
Lecornu also instructed that €200 million earmarked for cybercrime under the France 2030 investment plan be committed without further delay, with hardening ministerial systems the first priority. ANSSI, created in 2009, employs about 658 civil and military staff.
The admission follows confirmed intrusions into the Directorate General of Public Finances (DGFiP) in late June and late July that resulted in the theft of data on at least 678,000 individuals and professionals, including names, reference tax incomes, family quotients and withholding rates, plus cadastral records.
The tax administration confirmed the breaches on August 14, seven weeks after the first intrusion and only once the hackers had publicised their claim on a criminal forum. It has begun contacting a little more than 350,000 private individuals, and on August 18 acknowledged two further compromises.
David Amiel, minister for public action and accounts, has apologised to those affected. The Paris prosecutor’s office opened an investigation on August 15 into offences including fraudulent extraction of data.
The same period saw a separate breach at the education ministry, with the actor ZeroBytes claiming the exfiltration of roughly 43 gigabytes of data covering millions of pupils, staff and records spanning more than two decades.
ZeroBytes is the same actor behind the DGFiP theft and presents itself as two hackers of French nationality. Its education claim, published on August 18, cites 346 million raw lines the group itself describes as undeduplicated. The office of education minister Édouard Geffray said the intrusion matched an attack the ministry disclosed on July 31.
Lecornu had already ordered a detailed ANSSI audit of the tax incident on August 17, after a meeting of an interministerial crisis unit. Its recommendations are expected in September.
Lecornu described the current situation as “not acceptable”.
The shortcomings are particularly striking given France’s ambition to position itself as a European tech and digital-sovereignty leader, with major investments in data centres, artificial intelligence (AI) and sovereign infrastructure.
France’s own record is also contested in Brussels. The European Commission referred it to the Court of Justice of the European Union (CJEU) on July 8 over its failure to transpose the NIS2 directive on network and information security, due in national law by October 17, 2024.
At the same time Europe continues to face sustained Russian hybrid pressure, including cyber operations, sabotage of critical infrastructure and related threats.
France ranks among the countries most frequently targeted by cyberattacks, and the repeated compromises of core State systems have intensified pressure on the government to move beyond existing plans.
Cybercriminal “ZeroBytes” claims a major breach of France’s Education Ministry, alleging the theft of 43GB of data on millions of pupils, staff and records spanning two decades. https://t.co/AR3RbkFWBk
— Brussels Signal (@brusselssignal) August 18, 2026
