FICOBA: 1.2 million bank accounts exposed after intrusion into state systems

On 8 April 2026, French authorities confirmed they had stopped an illegitimate intrusion into FICOBA — the national bank-account registry (Fichier des comptes bancaires) operated by the Directorate General of Public Finances (DGFiP) — that had been running since late January 2026. The DGFiP had first disclosed the incident on 18 February 2026.

The attacker did not break encryption or exploit a software flaw: they used the usurped credentials of a civil servant who held legitimate access to FICOBA under inter-ministerial information-exchange procedures. By logging in as a trusted user, the intruder was able to query part of the registry undetected for several weeks before access was restricted.

About 1.2 million bank accounts were consulted — described by the tax administration as less than 1% of the records held in the file. FICOBA contains no balances, transaction histories or means of accessing funds; what was exposed was identity and contact data tied to bank accounts:

• Account holders' civil identities (names)
• Postal addresses
• Bank account details — IBAN and RIB
• Tax identification numbers in some cases

The DGFiP restricted the compromised access, notified the data-protection authority (CNIL) and filed a criminal complaint, while the Banque de France and major banks (BNP Paribas, Société Générale, Crédit Agricole, Crédit Mutuel and others) issued warnings. The chief residual risk is highly targeted phishing and social-engineering fraud built on the leaked personal and banking data; affected customers are urged to alert their bank so reinforced monitoring can be applied to their accounts.