FICOBA: 1.2 million bank accounts exposed. So now what?

The media pounced on the story with the usual mix of alarming figures and scare-you formulas. "Historic breach", "immediate risk", "your data in the hands of hackers"...

Let's breathe.

Because what happened with FICOBA deserves better than a knee-jerk reaction. It deserves a clear-eyed reading. And above all, it deserves that we ask the right questions; not the ones that generate clicks, but the ones that make you think.

What exactly happened with FICOBA?

FICOBA is the national register of bank and similar accounts. Created in 1971, it lists every account opened at French banking institutions: current accounts, savings accounts, securities accounts, rented safe-deposit boxes. That is 300 million accounts in total, managed by the Direction générale des Finances publiques (DGFiP).

Between 28 January and 13 February 2026, a malicious actor accessed this register. He was able to view and, in all likelihood, extract the data of 1.2 million accounts, less than 1% of the banking details held in the file.

What he obtained: your civil identity (surname, first name, date and place of birth), your postal address and your banking details (RIB and IBAN).

What he did not obtain: the account balances, the transactions, the ability to make a transfer. In its FAQ of 27 February 2026, the DGFiP specified that no password appears in FICOBA, and that neither users' tax identifier nor access to the impots.gouv.fr account was compromised.

The Fédération bancaire française confirmed it: this data alone is not enough to carry out a card payment or a transfer. That is worth spelling out, given how much the ambient panic implied that accounts were about to be emptied at any moment.

The DGFiP notified the incident to the CNIL, filed a criminal complaint, and is informing each affected person individually, by email or by post, in accordance with Article 34 of the GDPR.

So it is not serious, then?

It is. It is serious. Very serious.

Just not exactly for the reasons you're being fed on a loop.

Let's start with what is true: with your IBAN, it is technically possible to initiate fraudulent direct debits. It is not as simple as emptying an account, but it exists, and it happens. The Fédération bancaire française acknowledges it itself: a stolen IBAN can, under certain conditions, be used to set up a fraudulent mandate, provided the fraudster is registered with a bank as a direct debit originator. Monitor your statements. Report immediately any direct debit you do not recognize.

The real risk: social engineering

But the deeper threat, the one that gets talked about far less, is another one.

What has just been compromised is not only your account number. It is your digital identity in its entirety: surname, first name, postal address, date and place of birth, IBAN. A complete package. Coherent. Verifiable.

And that, for a scammer, is gold.

With this information, he can contact you posing as your bank, as the DGFiP, as your insurer. He won't guess your data: he already knows it. His message will be precise, fluent, credible. You will get the impression that he knows you. Because in a way, he does.

That is the real danger of FICOBA. Not the phantom transfer. The surgical manipulation. It is, moreover, the very first risk flagged by the DGFiP itself: phishing attempts and fake bank advisers, made credible by genuine data.

How could such access happen?

Here we get to the heart of the problem.

The attacker did not "hack" FICOBA in the way we picture it, a sophisticated operation, flashing screens, a team of geniuses in a dark room. He stole the credentials of a civil servant from outside the DGFiP, who had legitimate access to the register as part of the exchange of information between ministries.

In other words: someone stole a username and a password. And with that, he logged in. Quietly. Without arousing the slightest suspicion. For more than two weeks. With no monitoring, no alert, without anyone raising a hand.

Nada.

Let's ask the question plainly, because it deserves to be asked: how was access to 300 million French bank accounts neither protected by strong authentication nor watched by anomaly detection systems? This is the ABC of any digital security strategy worthy of the name in any company that takes itself even remotely seriously.

So the organization supposedly managing the security of our banking details, what exactly was it waiting for?

And while we're at it: this is the very same administration we are being asked to trust more, to centralize our identity data online, to digitize our interactions with the State even further.

This is not a sophisticated technical flaw. It is a human and organizational failure, deep, avoidable. Exactly the kind of failure I talk about in Être en cybersécurité: the weak link is almost never the technology. It's the human. And it's the process.

A grim run that is no accident

This case is not isolated.

Since the start of the year, France has suffered the breach of Service-Public.fr, an attack on the OFII, a leak at a Relais Colis provider, the compromise of the Fédération française de golf, and before that, the data of France Travail, of the CNAM, of health insurers, of hospitals...

A Surfshark report had already placed France at the top of European countries for the number of compromised accounts in 2025. And the trend is getting worse: according to Surfshark, 43.4 million accounts linked to France were compromised in the first half of 2026 alone, up 62.3% on the previous half-year. France alone accounts for 58% of compromised accounts in Europe, and ranks second worldwide, behind only the United States and its 90.8 million accounts, out of 313.4 million recorded across the planet. Relative to its population, France even posts the highest ratio of compromised accounts in the world: per inhabitant, no country is more exposed.

This is not bad luck. It is the symptom of a structural problem: French public cybersecurity is underfunded, fragmented, and treated as an administrative constraint rather than a strategic priority.

NIS2 is still awaiting full transposition. Access permissions are poorly managed. Training public agents in good practices remains anecdotal. And the culture of digital risk, the one that would keep a civil servant from getting his credentials phished, is not yet embedded in organizations.

How can you protect yourself after the FICOBA leak?

First thing: breathe.

Your data is probably already somewhere online. Not only because of FICOBA, because of France Travail, of the CNAM, of your health insurer, of that app you installed in 2019 and forgot about since. Leaks have been piling up for years. They cross-reference, complete and aggregate each other.

Accepting that is liberating. It doesn't mean giving up. It means stopping waiting for the problem and starting to anticipate it.

My principle, the one I repeat to every company I work with, in every training course I give and also in my book Être en cybersécurité: be politely paranoid.

Not anxious. Not paralyzed. Just methodically wary, with a smile.

In practice, what does that look like?

Any contact you did not initiate is suspect by default. A call from your bank? Hang up and call back yourself using the number on the back of your card. A text from the DGFiP with a link? Trash. An email that knows your IBAN and asks you to "confirm" anything at all? Trash, and fast. The rule is simple: if it's urgent and it comes from the outside, it's probably fake. Real emergencies, you handle them by calling the organization back yourself. And always call back on a number found in an official directory, never through your phone's "call back" function.

Check your FICOBA accounts. Since 2025, it's available on impots.gouv.fr, under "Autres services". In a few clicks you can see which accounts are linked to you there. Do it, not because it's urgent; but because regaining control starts with knowing where you stand.

Enable two-factor authentication everywhere. Email first. Banking and tax services next. Everything else after. It's the simplest and most effective measure there is for reducing your exposure. It costs nothing. It protects a lot.

Monitor your direct debits. A stolen IBAN does not let anyone empty an account, but a fraudster can try to set up a fake direct debit mandate. The DGFiP recommends logging in to your online banking at least once a week. Better still: ask your bank for a white list of authorized creditors, which automatically rejects any direct debit issued by a creditor you have not explicitly approved. Any direct debit you do not recognize can be disputed with your bank, and you have thirteen months from the debit date to do so (Article L133-24 of the French Monetary and Financial Code).

FICOBA is not the end of the world. But it's one more reminder that in today's digital world, the best protection is you. Not your bank. Not the State. You.

Politely paranoid. Always.

What this case reveals, at bottom

I say it often, and this incident confirms it once again: cybersecurity is not a tools problem. It's a culture problem and a human problem.

I insist on this idea: clear-headedness is worth more than fear. Understanding how attacks actually work, not the Hollywood version but the reality on the ground, is what lets you make the right decisions, individually as well as collectively.

This FICOBA breach is not an irreparable catastrophe for the people affected. But it's a strong signal we cannot go on ignoring: as long as digital security remains a subject for specialists and not a subject of governance, these incidents will keep repeating.

And next time, the exposed data may be even more sensitive.

Want to go further and truly understand how cybersecurity works, not to become an expert, but to stop being on the receiving end? My book Être en cybersécurité is made for that.

---

Sources

• Timeline of the intrusion, data concerned and the absence of any compromise of the tax identifier, the balances and impots.gouv.fr access: DGFiP, FAQ of 27 February 2026, impots.gouv.fr, illegitimate access to the FICOBA register and French Ministry of the Economy, everything you need to know about the illegitimate access to FICOBA.
• Impossibility of emptying an account, risk of a fraudulent direct debit mandate and call for vigilance: Fédération bancaire française.
• How FICOBA works and the white list of authorized creditors: La finance pour tous, 20 February 2026.
• Stolen credentials of a civil servant, notification to the CNIL and criminal complaint: Help Net Security, 19 February 2026.
• France, the country worst hit by data leaks in the first half of 2026 (43.4 million accounts, 58% of compromised accounts in Europe, second place worldwide and the highest per-capita ratio in the world): Surfshark study, reported by Yahoo Finance, Usine Digitale and Le Journal du Geek, 28 July 2026.