Within just a few weeks, tens of millions of people were affected: patients, customers, employees, political refugees, travelers, families of inmates. Behind each number are destabilized lives: patients exposed to identity theft, families threatened by criminal networks, luxury clients targeted for their purchasing power, refugees endangered by the disclosure of vital information. These incidents are not isolated—they reflect a broader trend: a global industrialization of attacks, fueled by data monetization on criminal marketplaces and amplified by geopolitical dynamics. France, particularly hard-hit in recent months, exemplifies this situation.

That is precisely the aim of this issue: to focus on the latest major data leaks, analyze the tactics used, assess the concrete impacts, and draw professional lessons

Public Administration: The Recurring Vulnerability of National Services

France Travail

📅 July 2025

A leak from the Kairos application exposed information on 340,000 job seekers. Personal data—names, addresses, emails, phone numbers, and France Travail identifiers—were exfiltrated via a partner portal. This incident comes one year after a massive breach affecting 43 million individuals, confirming the system’s persistent fragility.

Data exposed: identification and contact data (a socio-professional profile highly vulnerable to social-engineering risk).

Pro takeaway: public agencies must strengthen security for their partner applications. Every external access point is a potential weakness in a critical national system.

A year earlier, 43 million job seekers had already had their data siphoned off: names, addresses, phone numbers, Social Security numbers. The attackers didn’t even break in—they posed as staff from Cap Emploi, a France Travail partner, and obtained a password with a simple call to internal support.

The scenario had been explicitly identified back in 2022 in a risk analysis recommending two-factor authentication. By failing to act in time, the organization let the wolves into the fold.

Nor was it the first warning. 1.5 million identities exposed in 2021, 10 million sold in 2023… In three years, France Travail has leaked the equivalent of over half the French population. This series no longer points to a mere technical vulnerability, but to a systemic failure of governance and accountability.

Other public administrations and government contractors abroad have suffered major breaches. In Canada, the House of Commons saw its systems compromised via a Microsoft flaw, exposing internal staff data. In U.S. prisons, Everglades Correctional Institution inadvertently provided dangerous inmates with the contact details of all visitors, turning a simple internal error into a direct physical threat for hundreds of families. In the UK, the Ministry of Defence failed again: after 20,000 victims of the Afghan ARAP program in 2023, a second leak in 2025 affected 3,700 nationals, confirming chronic weakness in third-party management.

Healthcare: A Front-Line Sector Facing Massive Exfiltration

Hôpital privé de la Loire

📅 June–August 2025

A French hacker using the alias Marak exploited a vulnerability in a poorly secured internal application and stolen credentials to penetrate the management system of Hôpital privé de la Loire in Saint-Étienne. The attack led to the theft of 530,000 patient records and 45,000 identity documents—one of the largest medical leaks recorded in France.

Data exposed: first and last names, dates of birth, full addresses, phone numbers (mobile, landline, work), insurance information, administrative documents, ID cards, residence permits, passports, summaries of medical consultations, and patient ID labels. Detailed medical data (reports, results, prescriptions) and bank details were not compromised.

Pro takeaway: credential compromise remains the most critical entry point. A poorly secured internal application combined with a compromised medical account can be enough to expose half a million patients. Access protection (MFA, segmentation, monitoring) must become an absolute priority in the hospital sector.

Abroad, the numbers are dizzying: Western Montana Mental Health Center exposed 87,000 patients, Highlands Oncology 113,500, and McKenzie Memorial Hospital more than 54,000 records. Even a dental practice—or a postal mailing error as at Michigan Medicine—has been enough to expose thousands. Healthcare remains one of the most targeted sectors, where each breach becomes a social time bomb.

Telecom: Operators Targeted for Monetizable Customer Bases

Bouygues Telecom

📅 August 2025

On August 4, the operator detected a cyberattack that exposed data for 6.4 million customers—nearly a quarter of its base. Compromised information includes personal and contractual data, contact details, civil status or company information for business clients, and IBANs. Bouygues notes that passwords and card numbers were not affected. Impacted customers are notified individually. The incident is part of a series of leaks hitting French operators (Free, SFR, Coriolis, Corsica Telecom), revealing the industrialization of customer-database resale on the dark web.

Data exposed: personal and contractual information, contact details, civil status/company information, IBANs (partial banking data).

Pro takeaway: telecom operators have become an industrial-scale target for cybercrime. Protecting contractual and partial banking data (like IBANs) is strategic, as these feed sophisticated identity-theft fraud and targeted phishing.

In the UK, Colt Telecom suffered a paralyzing ransomware attack, with one million internal documents put up for sale for $200,000. The repetition of such cases confirms telecoms are no longer targeted solely for espionage but for their raw value: tens of millions of monetizable contractual records on underground forums.

Luxury: Social Engineering as the Brands’ Achilles’ Heel

Chanel

📅 July 2025 (disclosed August 2025)

An attack exploited a CRM contractor based on Salesforce, targeting a database linked to North American customer service. Compromised data concerns customer contacts (identity and contact details), with no impact on financial information. The attack was not technical but hinged on sophisticated social engineering to bypass platform protections and obtain access through human manipulation. Chanel responded discreetly, but the incident illustrates the vulnerability of peripheral digital ecosystems in the luxury sector.

Data exposed: names, email addresses, postal contact details, phone numbers (customer data).

Pro takeaway: social-engineering attacks against cloud providers show resilience isn’t only about technology. In luxury, client trust is a strategic asset: compromising it—even partially—weakens the brand and fuels targeted manipulation or extortion campaigns.

A few weeks earlier, Louis Vuitton Hong Kong saw 419,000 customers impacted, after other breaches in Korea and the UK. Luxury groups are now caught in a coordinated campaign where premium customer databases are exploited for highly profitable targeted scams.

Tourism: Reservation Systems Weakened at Peak Season

Center Parcs

📅 June 2025

A cyberattack targeted the Center Parcs holiday-village chain, compromising data for around 20,000 European customers. The intrusion affected the phone reservation system, which was suspended on June 6, two days after detection.

Data exposed: first and last names, email addresses, phone numbers, as well as reservation details (stay dates and locations). Bank details, postal addresses, and passwords were not affected.

Pro takeaway: even “limited” data can power highly convincing phishing campaigns. Reservation systems, especially sensitive during peak season, must be secured to the same standard as financial systems.

Transport: Customer-Care Platforms Turned into Entry Points

Air France–KLM

📅 August 2025

A compromise of a customer-service platform allowed attackers to access passengers’ personal data. The airlines’ core systems were not affected, and no sensitive data such as passports, passwords, or payment cards were compromised. Stolen information primarily includes traveler identity and contact details, loyalty programs, and recent transactions. The case was reported to the CNIL and the Dutch data-protection authority. The ShinyHunters group, already active in campaigns targeting Salesforce, is suspected.

Data exposed: names, email addresses, phone numbers, loyalty information, transaction details.

Pro takeaway: SaaS customer-relationship platforms are prime targets. Any uncontrolled access opens the door to mass phishing and loyalty-program abuse.

The Air France–KLM leak highlights airlines’ growing dependence on digital contractors—a weak link that has become a preferred target. The phenomenon also hits global players: in Australia, Qantas Airways saw the data of 6 million passengers exposed after a third-party call-center platform was compromised. The Scattered Spider group, already known for attacks against aviation, is suspected to be behind this operation.

Defense: Where Cybersecurity Meets Information Warfare

Naval Group

📅 July 2025

An unknown actor (Neferpitou) claimed to hold 1 TB of sensitive data, briefly publishing excerpts before the links were taken down. The files concerned frigates and submarines, including internal documents, technical screenshots, and part of the source code for the STORM weapons system. Naval Group and ANSSI detected no intrusion and described the case as a reputational attack.

Data exposed: internal documents related to FDI and FREMM frigates and SSN/SSBN submarines; part of the STORM source code confirmed by Naval Group; videos of older systems (2003); technical screenshots and guides; content not classified “secret-défense” but relevant to industrial security; a heterogeneous and only partially exploitable set overall.

Pro takeaway: the Naval Group case is likely not a massive cyberattack but a sophisticated reputational operation. It illustrates the convergence of cybersecurity, competitive intelligence, information warfare, and financial markets. The leak coincided with financial results, triggering a 3.4% drop in Thales’ share price. The lesson for professionals is clear: defense doesn’t stop at firewalls—it includes narrative management, competitor monitoring, and the ability to protect brand equity in strategic contexts.

The French case resonates with other critical breaches. In the UK, the Ministry of Defence disclosed a second leak affecting 3,700 Afghan refugees, after a prior incident that had already exposed 20,000 people. In Canada, Parliament suffered a compromise linked to Microsoft, endangering internal infrastructure. In the United States, Everglades Correctional Institution even mistakenly released visitor contact details to inmates, turning a leak into a physical threat. The public and military spheres illustrate the systemic dimension of cyberattacks: it’s not just data at stake, but lives and strategic balances.

📍 Key Takeaways

Recent leaks confirm three major dynamics:

• SaaS/third-party supply chain as the leading access vector (Salesforce, partner portals, reservation/call-center systems).

• Mass theft of highly monetizable data (PII, PHI, official identifiers, customer preferences, loyalty programs), with or without encryption—marking a pivot from pure ransomware to data-centric extortion (RansomHub, Medusa, WarLock) and advanced social engineering (ShinyHunters, Scattered Spider-style).

• Exploding “critical third-party” risk across Healthcare, Public, Luxury/Retail, Aviation, and Telecom, where “peripheral” systems (helpdesk, CRM, IRB/procedures, mailing) prove as sensitive as core business systems.

Tracing the incident timelines reveals a clear pattern. The most exploited entry points are no longer misconfigured firewalls, but critical third parties and SaaS. Salesforce, partner portals, call centers, and reservation systems have become initial-access highways (T1195).

Social engineering is gaining ground: MFA fatigue, resets via support or call centers… Campaigns against Allianz Life, Chanel, and the aviation sector remind us that the human link in helpdesks remains the most exploitable weakness (T1566).

Next come software vulnerabilities, still a formidable weapon in attackers’ arsenals. Whether collaboration apps, mail servers, or cloud solutions, published flaws and zero-days are exploited without delay. Recent campaigns, for example, used critical SharePoint flaws (RCE CVE-2025-53770: exploited as a zero-day by WarLock [Colt]) and Exchange (CVE-2025-53786: lateral movement and hybrid persistence) to gain persistence and move laterally.

Alongside these, stolen credentials (T1078) are sometimes enough to tip everything over. In Saint-Étienne, a single poorly secured internal account exposed more than half a million patients (Hôpital privé de la Loire).

These cases confirm a SaaS-centered, data-oriented, and very “human” threat (SE, support, contractors). A CERT should equip itself for mass-export detection, third-party access monitoring, post-CVE Microsoft threat hunting, and playbooks for “compromised provider” scenarios—alongside defensive influence capabilities to counter reputational risk.

Note

Handling data obtained from leaks exposes you to severe criminal penalties:

• Unlawful possession of personal data (up to 5 years’ imprisonment – Art. 226-18 of the French Penal Code)

• Unauthorized access to an automated data-processing system (STAD) – Arts. 323-1 to 323-3 of the French Penal Code

• Breach of professional secrecy, correspondence secrecy, or national defense secrecy

• Infringement of proprietary code or protected databases (Directive 96/9/EC)

Ignorance of the law is no excuse. Storing, analyzing, or redistributing data from a leak without an explicit legal basis (authorization, legitimate interest, authorized investigative mandate, etc.) exposes you—and your employer—to major criminal and contractual risks.

🔎 Practical advice: if you access a leak as part of an audit or OSINT monitoring, document the purpose, limit retention, encrypt access, and consult your DPO or legal counsel before taking any action.