French Government Platform Resana Listed in Alleged 990K-Record User Data Sale
French government collaboration platform Resana's 990K user records allegedly sold on dark web by xMetah.
Run French Government?
Get an email when a reviewed story names French Government, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A threat actor using the alias xMetah claims to be selling a database allegedly belonging to Resana, a French government collaboration platform hosted on the state's numerique.gouv.fr domain, containing approximately 990,000 user records. The breach affects a critical government infrastructure tool and raises significant concerns under GDPR and French data protection regulations. This incident highlights vulnerabilities in state-operated digital platforms and suggests potential exposure of French government employees and citizens' personal data.
The lesson from this incident
Full lessonA threat actor claims to be selling nearly 1 million user records from Resana, a French government collaboration platform, highlighting critical vulnerabilities in state-operated digital infrastructure. This breach demonstrates how inadequate security controls on government platforms can expose sensitive personal data of both public employees and citizens. The incident raises serious concerns under GDPR and French data protection laws, potentially resulting in significant regulatory penalties and loss of public trust. Government platforms require enhanced security measures due to their critical nature and the sensitive data they process.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.
Indicators of Compromise
- domain — numerique.gouv.fr