Attacker gets into France's DB listing all bank accounts

"France's Ministry of Economics, Finance and Industrial and Digital Sovereignty last week revealed the incident took place in January, after unknown attackers used stolen credentials to access the database. The Ministry said the attacker's access was restricted immediately upon discovery of the attack, but that the miscreant still managed to access personal information about 1.2 million accounts, including account numbers, account holder's addresses, and tax identification numbers."

"According to Unit 42 researchers, cyber-scum are aware of the two 9.8-rated CVEs - CVE-2026-1281 and CVE-2026-1340 - and are targeting unpatched systems. State and local governments, healthcare, manufacturing, professional and legal services, and the tech sector in the US, Germany, Australia, and Canada have all been peppered by attackers leveraging those vulnerabilities. Unit 42 reports that attackers have tried to exploit them by establishing a reverse shell, installing web shells, downloading malware, and conducting reconnaissance in a search for further vulnerabilities."

An unknown attacker accessed the French government's database listing every bank account in the country and stole personal information for 1.2 million accounts, including account numbers, account holders' addresses, and tax identification numbers. The Ministry of Economics, Finance and Industrial and Digital Sovereignty reported that stolen credentials were used in January and that access was restricted immediately upon discovery while response agencies were mobilized. Palo Alto Networks Unit 42 reported two 9.8-rated Ivanti EPMM vulnerabilities (CVE-2026-1281 and CVE-2026-1340) are being actively exploited to establish reverse shells, install web shells, download malware, and conduct reconnaissance against unpatched systems. Targeted sectors include governments, healthcare, manufacturing, professional services, and tech across multiple countries; patches are available and do not require downtime. Debate continues over the legitimacy of a group calling itself 0APT.

Read at Theregister