France's national cyber incident team, CERT-FR, published report CERTFR-2026-CTI-008 on 20 October reviewing nearly 200 web-application data breaches it tracked in 20251. It found that many needed no technical vulnerability, only low-complexity actions by the attacker. ENISA's annual threat report in September also covered 2025, counting incidents across the EU; CERT-FR's review looks instead at how the breaches happened. For French organisations, the report points at configuration and access hygiene on web applications rather than at patching alone.
22OCT
CERT-FR reviews nearly 200 web breaches
1 min read
16:31UTC
France's CERT-FR reviewed nearly 200 web-application data breaches from 2025 and found that many needed no technical vulnerability, only low-complexity attacker actions.
TechnologyAssessed
Key takeaway
Many French web-application breaches in 2025 needed no software flaw, CERT-FR found.
Deep Analysis
In plain English
France's national cyber emergency team looked back at nearly 200 cases in 2025 where data was stolen from websites and online apps. It found many thefts needed no clever hacking. Attackers used simple steps, such as abusing features left open, that a software update would not have stopped.
Root Causes
Web applications expose administration panels, APIs and export functions that work as designed but lack access limits or rate controls. An attacker who abuses intended features needs no exploit, so no patch closes the gap.
What could happen next?
- Meaning
Organisations measuring security by patch compliance alone may miss the configuration failures behind many web data breaches.
First Reported In
Update #15 · Fridge hack spoils food in seven countries
CERT-FR· 22 Oct 2026
Read original →Different Perspectives
Hospital Sírio-Libanês
Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.
The Foschini Group
The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.
FirstVDS
FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.
ESET
ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.
JPCERT/CC
JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.
Cyber Security Agency of Singapore
The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.