A major data breach in northern France has exposed personal information belonging to approximately 545,000 people, prompting warnings over potential phishing attempts and financial fraud.
The Hauts de France regional authority confirmed that two of its service providers, Atexo and Docaposte, were targeted in a cyberattack that allowed unauthorized access to data processed on behalf of the region.
According to French media reports, regional president Xavier Bertrand said data belonging to nearly 545,000 people had been leaked. Names, surnames, email addresses and information relating to access rights are among the data affected.
The situation could be even larger than the confirmed figure.
Cybersecurity monitoring site FrenchBreaches says a hacker has claimed possession of more than 782,000 records linked to roughly 700,000 people, as well as approximately 90,000 documents. Those figures have not been fully confirmed by the regional authority.
Potentially compromised files may include RIB banking information and other identification data. French authorities have stressed that investigations are still underway to establish exactly what information was accessed or extracted.
The affected platforms are connected to regional assistance programs, including Génération #HDF, which is used by students and other beneficiaries.
Importantly, officials say the regional government's own computer systems were not directly breached. The attackers instead gained access through the systems of the two external service providers.
The affected platforms have since been taken offline, authorities have filed a complaint and people identified as potentially affected are being notified.
Cybersecurity experts are warning users to be particularly cautious about emails, text messages and phone calls that appear to come from regional authorities or banks.
Anyone potentially affected should avoid providing passwords or verification codes in response to unsolicited messages and closely monitor bank accounts for suspicious activity.
The incident is another reminder of the growing risk created when government agencies and large organizations entrust sensitive personal information to external technology providers.
