1.2 million bank accounts: data leak at FICOBA

On 18 February 2026, France's Ministry of the Economy and Finance (Bercy) — operator of FICOBA, the national registry that lists every bank account opened in France — confirmed that a malicious actor had illegitimately consulted the file, affecting roughly 1.2 million bank accounts.

According to the Direction Générale des Finances publiques (DGFiP), the intrusion began at the end of January 2026 when the attacker usurped the credentials of a civil servant who held legitimate access to the file as part of inter-ministerial information exchange. Using those stolen identifiers, the intruder was able to query and extract records before the activity was detected. Account balances and transaction details were not exposed, as FICOBA does not hold that information.

The exposed data categories include:

• Bank account details (IBAN / RIB)
• Account holder's identity, date and place of birth
• Postal address
• Tax identification number (in some cases)

On detection, the DGFiP immediately restricted access to halt the intrusion and limit the volume of data consulted. The incident was notified to France's data protection authority (CNIL) — a first notification on 16 February 2026, completed on 23 February — and a criminal complaint was filed. DGFiP IT teams worked with the ministry's senior defence and security official and the national cybersecurity agency ANSSI to remediate the incident and harden the system. Affected account holders were notified individually, and authorities warned of an elevated risk of targeted banking scams and phishing.