Summary
- CERT-FR followed nearly 200 web application data breaches during 2025.
- Many involved comparatively simple techniques without exploitation of a technical software vulnerability.
- The authority has published ten risk reduction measures based on investigations and practical incident response work.
France’s national cyber incident response service followed nearly 200 breaches involving web applications during 2025, finding that many attackers extracted sensitive information through relatively simple actions without exploiting technical software vulnerabilities.
The CERT-FR, part of France’s national cybersecurity authority ANSSI, published its findings on 20 October in a report drawing lessons from investigations and assistance provided to affected organisations.
The authority describes substantial consequences for individuals whose information was exposed, including direct harm and the possibility that stolen records could support more convincing fraud.
Its analysis focuses on applications processing sensitive data and identifies ten ways to reduce repeated breaches through improvements to existing systems. The measures are drawn from actual incident response work rather than a theoretical security framework.
Data extraction does not always require a new vulnerability
Security responses to compromised web applications frequently focus on software defects that can be corrected by updating a component or applying a vendor patch.
CERT-FR’s findings highlight a different category of exposure. In many of the incidents it followed, attackers were able to extract information without relying on the exploitation of a technical vulnerability.
That observation does not establish that the affected applications were correctly secured, nor does it mean the attackers acted without exploiting weaknesses in the broader system.
An application may permit an operation that exceeds what a particular account or user should be authorised to perform. Sensitive information may also be accessible through a configuration, account privilege or exposed function that creates opportunities for misuse.
Those possibilities require separate investigation. CERT-FR’s published overview does not attribute all 200 cases to one access mechanism or identify a common product vulnerability responsible for the incidents.
The distinction affects remediation because replacing a vulnerable software package may not correct an inappropriate permission, an exposed data interface or a problem in how an application handles requests.
Web applications commonly sit between users and information held in databases or external services. They may provide search, reporting, document retrieval and administrative functions that legitimately return substantial volumes of information.
Whether those functions expose sensitive records appropriately depends on their access rules, the identities invoking them and the way results are restricted.
Consequently, an investigation must establish not only how a person reached an application but also what the application allowed that person to retrieve.
The consequences extend beyond the initial disclosure
CERT-FR emphasises the effects that application data breaches can have on the people represented in the compromised records.
Exposed personal information may cause immediate harm, but it can also support later fraud when attackers combine accurate details about individuals with other information.
For example, contact information and personal circumstances can make a fraudulent communication appear more credible than a generic message. Information about a person’s relationship with an organisation may also help an attacker construct a convincing impersonation.
The French authority does not state that every breach in its dataset led to subsequent fraud. It identifies the potential for stolen information to be reused and explains why the consequences of disclosure can continue after the initial incident is contained.
Determining the extent of exposure may also take longer than establishing that unauthorised access occurred. Organisations may need to reconstruct which functions were accessed, which records were returned and whether information was copied elsewhere.
Where an application lacks sufficiently detailed records of those actions, the investigation can become more uncertain.
That uncertainty affects the information an organisation can provide to individuals, regulators and other parties with a legitimate interest in the incident.
It is therefore important to distinguish between evidence that an attacker reached a service and evidence that specific personal records were obtained. Neither conclusion should be inferred automatically from the other.
Recommendations address existing applications
The new CERT-FR report sets out ten practical risk reduction approaches that organisations can apply over the short and medium term.
It includes technical annexes illustrating how the principles can be implemented using technologies encountered during ANSSI’s investigations.
The authority explicitly states that the publication is not an exhaustive security guide or a specification for an ideal long-term architecture.
Instead, it addresses applications and systems already handling sensitive information, where operational requirements may limit how quickly a service can be replaced or comprehensively redesigned.
That scope follows from the incident response work on which the report is based. Where an existing application has been breached, an organisation may need to reduce exposure while retaining essential functionality and preserving access for legitimate users.
Corrective measures therefore have to reflect the application and its operating environment, rather than treating every reported incident as evidence that the same patch or configuration change should be deployed everywhere.
Changes to access controls, application behaviour or supporting infrastructure may also have operational effects. Those changes need to be evaluated against the functions the application is expected to provide.
In particular, a restriction that appears effective against one observed route may leave an equivalent route available elsewhere if the underlying security principle has not been applied consistently.
Lessons extend beyond the original social sector investigation
The report follows an earlier CERT-FR publication from 2024 that concentrated on incidents affecting the social sector.
The 2026 work broadens that previous analysis to web applications processing sensitive data more generally.
The authority’s use of incident response experience is relevant to that expansion. Rather than identifying a particular software product or threat actor as the common cause, it examines recurring conditions associated with information loss and the controls used to address them.
Its findings also place limits on what can be concluded from a vulnerability inventory alone. A system may have no known outstanding software CVE and still handle sensitive information in a way that exposes it to unauthorised access.
Conversely, identifying a potential application weakness does not establish that a breach occurred or that particular records were taken.
CERT-FR’s October publication provides ten measures and accompanying implementation examples intended to strengthen existing applications. The authority presents them as practical ways to reduce recurring breaches, not as proof that one security control could have prevented every incident it followed in 2025.
