Breaches and incidents
ANSSI (France’s national cybersecurity agency): 118 accounts on innovation-lab Metabase compromised
Per IT-Connect and Journal du Geek, ANSSI’s 30 Sep 2026 REACTIV situation report disclosed the compromise of 118 Metabase user accounts used by ANSSI’s...
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- Per IT-Connect and Journal du Geek, ANSSI’s 30 Sep 2026 REACTIV situation report disclosed the compromise of 118 Metabase user accounts used by ANSSI’s innovation lab, about thirty of them external; exposed data includes usage statistics, account identifiers and email addresses. DINUM also had two Metabase instances (ProConnect and Nuage-Public) compromised, per IT-Connect.
- Root cause: a Metabase vulnerability; Journal du Geek describes “an SQL injection flaw” allowing “an unauthenticated attacker” in. Per IT-Connect, the accounts were on “a Metabase platform used by the ANSSI innovation lab”.
- No attacker named.
- ANSSI updated vulnerable instances and reset passwords for all accounts. The CERT-FR page CERTFR-2026-CTI-006 (fetched) confirms the REACTIV operation ordered by the Prime Minister on 1 Sep 2026 but did not show the ANSSI incident text in the version retrieved.