Nearly 80 percent of people in France have personal data circulating for sale on the darknet following major cyberattacks and public-sector breaches, according to a high-ranking Gendarmerie official speaking in Toulon on October 8, 2026.
The staggering proportion was revealed by General André Petillot, major general of the Gendarmerie nationale, during the Rencontres stratégiques de la Méditerranée conference organized by the FMES foundation. The high-ranking security official warned that the compromised information varies widely in depth depending on the individual targeted.
While some leaked profiles contain only basic coordinates, others assemble comprehensive personal dossiers. General Petillot stated, There are some people for whom there is everything: address, telephone number, email address, health data, etc.
noting that the resold records fuel fraudulent loan applications and various scams across the country.
France Ranks Among Nations Most Targeted by Data Leaks
Surfshark published research in July showing that 43.4 million French accounts suffered compromises during the first half of 2026, representing a surge of more than 62 percent compared with the final six months of 2025. The gendarmerie warning arrives as digital security professionals point to France as a primary target for international cybercrime.
Security specialists note that the country trails only the United States in global leak volume, driven by high-profile intrusions affecting both private companies and critical state machinery. That volume places France at the forefront of European nations impacted by data violations.
Recent months brought severe breaches within public institutions, including a massive intrusion targeting the French tax administration over the summer. Another breach involving the French Shooting Federation allowed criminals to pinpoint the home addresses of gun owners and execute targeted residential burglaries to steal weapons, according to security reports.
Public Infrastructure Vulnerabilities Expose State Security Flaws
Yann-Maël Larher, an attorney admitted to the Paris Bar and a specialist in digital law, argued that public-sector platforms account for roughly half of the exposed information following state disclosures regarding Brixhub, an open and free search engine that allows users to query personal identities and uncover leaked records.
Yann-Maël Larher said that this affair will perhaps have the merit of bringing to light the gaping flaws in our system, starting with the state’s IT systems, because half of the information revealed comes from public platforms.
The legal expert emphasized that state portals such as France Connect, ANTS, and France Travail harbor severe vulnerabilities. Pointing to the asymmetric enforcement of digital regulations, Larher questioned why authorities penalize private corporations heavily while state infrastructure suffers systemic losses without equivalent accountability.
Hugues Foulon, chief executive officer of Orange Cyberdéfense, warned during the Toulon conference that public infrastructure frequently lags behind the security standards required in an accelerating digital environment.
Cumulative Database Leaks Drive Practical Defenses
Catalogues maintained by tracking services like Have I Been Pwned document major French data spills, including a 13.9 million user record leak at Free Mobile in October 2024, a 5.7 million record breach at Bouygues Telecom in August 2025, and a leak via Pass’Sport in December 2025. Security analysts note that the 80 percent figure represents a verbal estimation from law enforcement rather than a single unified registry, reflecting years of accumulated data leaks rather than one isolated event.
Because bad actors merge these historical records into comprehensive dossiers, cybersecurity professionals urge citizens to adopt rigorous digital hygiene. An expert advised users to secure primary email accounts with multi-factor authentication and unique passwords, while warning that services demanding payment to remove data from public search engines amount to extortion.
- Never share a six-digit verification code received via SMS or app with an incoming caller.
- Verify callers independently by hanging up and dialing official organization numbers found on verified websites.
- Prioritize securing primary email inboxes, as they serve as the recovery hub for all linked online services.
- Inform financial institutions immediately if banking identifiers or IBAN numbers appear in compromised datasets.