Latest / Tech Talks With Kinsoft / France's FICOBA Registry Breach – 1.2M Bank Accounts

Transcript

France's FICOBA Registry Breach – 1.2M Bank Accounts · Tech Talks With Kinsoft

0:00
Welcome to Tech Talks with Kinsoft. Imagine holding
0:03
the routing instructions for like 1 .2 million
0:07
bank accounts. Yeah, that is a staggering amount
0:10
of financial data. Right. And you can't see the
0:12
balances and you can't just click a button to
0:15
transfer the money out yourself. But you know
0:17
exactly who owns every single account. You know
0:19
where they live, their names, everything. Exactly.
0:21
And even their government issued tax ID. In January
0:25
2026, someone spent 16 completely uninterrupted
0:29
days inside France's National Bank Account Registry
0:32
gathering exactly that information. Which is
0:35
just wild to think about. It really is. So our
0:38
mission here on the show is to take a stack of
0:40
complex. collect sources, you know, security
0:42
bulletins, official ministry reports, news articles,
0:44
and just extract the most important nuggets of
0:47
knowledge for you. Yeah, we give you a shortcut
0:48
to being well -informed without the information
0:51
overload. Getting straight to the context of
0:53
why these events actually impact you. And today
0:55
we are analyzing a massive exposure involving
0:58
a system called FICOBA. Right, FICOBA. And to
1:01
understand the gravity of this event, we really
1:04
have to establish what FICOBA actually represents.
1:07
Because it's not just a small regional database,
1:09
right? Oh, not at all. This is not a localized
1:11
database for a single bank. FICOBA is the centralized
1:15
national registry in France. It tracks nearly
1:17
300 million bank accounts. Wow. 300 million.
1:22
Yeah. For around 80 million people. It is essentially
1:25
the master index of financial existence within
1:28
the country. If you have an account operating
1:30
in France, your information is sitting in this
1:32
registry. Which makes it a staggering target
1:34
for anyone looking for data. So our goal today
1:37
is to examine how the data of 1 .2 million of
1:40
those bank accounts was walked out the door in
1:42
late January 2026. Right. We're looking at why
1:45
this wasn't. you know, a traditional breach and
1:47
crucially, what an attacker can actually do with
1:50
this very specific combination of stolen data.
1:52
Okay, let's unpack this. Let's do it. So the
1:55
initial entry. According to reporting from TV5
1:57
Mond and disclosures from the French Ministry
2:00
of the Economy and Finance, the attackers didn't
2:03
break down any firewalls. Right. There's no sophisticated
2:06
hacking involved. No, they didn't write some
2:08
brilliant piece of malicious code to force their
2:10
way into a mainframe. They just obtained the
2:13
legitimate login credentials of a fully authorized
2:16
civil servant. What's fascinating here is they
2:19
walked right through the front gate wearing the
2:21
uniform, basically. Yeah. By using a legitimate.
2:25
Authorized credential the attackers were able
2:27
to quietly access and query the registry for
2:31
about 16 days 16 days over two weeks of uninterrupted
2:35
access to a national database. Yeah before anyone
2:38
realized hostile actor was pulling records I
2:41
have to push back on how we frame these incidents
2:43
though I mean we're calling this a massive cybersecurity
2:45
vulnerability but isn't this fundamentally just
2:48
human error have you mean well if a government
2:51
employee gets tricked by a phishing email or
2:54
hands over their password or I don't know writes
2:56
it on a sticky note no IT system in the world
2:59
can patch human gullibility that is a fair point
3:01
yeah So why are we treating this like a sophisticated
3:04
technical failure instead of just a basic human
3:07
resources and training issue? This isn't an Ocean's
3:11
Eleven vault heist with lasers and explosives.
3:14
Right. This is someone swiping the night manager's
3:17
key card and wandering the file room for over
3:19
two weeks. It's a great analogy, but that assumes
3:22
the only layer of defense a system should have
3:25
is the initial password. Okay, go on. A modern,
3:28
centralized infrastructure holding the sensitive
3:31
financial data of 80 million people cannot rely
3:35
solely on a single point of human failure. When
3:38
the perimeter is secured by a login, the behavior
3:41
of that identity becomes the new security perimeter.
3:43
I see what you're saying. Right. So if an authorized
3:46
civil servant suddenly starts downloading or
3:48
querying 1 .2 million individual records, which...
3:51
is almost certainly far beyond any normal daily
3:54
administrative workflow. The system should trigger
3:56
an immediate anomaly alert. So the failure isn't
3:59
just that the password was stolen. The failure
4:01
is the lack of internal alarms. The system saw
4:04
that night watchman suddenly loading two tons
4:07
of filing cabinets into a moving truck and just
4:10
assumed it was part of his normal shift. That
4:13
is the core issue with legacy identity and access
4:15
management. Intrusion detection systems are traditionally
4:19
built to keep unauthorized people out. Like a
4:22
wall. Right, like a wall. But when the system
4:24
looks at the login and verifies it as an authorized
4:27
user from a recognized portal, it often just
4:30
waves them right through and stops monitoring
4:32
their behavior. The system has no way of knowing
4:35
the human behind the keyboard has malicious intent
4:38
unless it is actively monitoring for bizarre
4:41
data access patterns. Yeah, and if I have 16
4:43
days inside that system without setting off any
4:45
alarms, I am trying to grab every piece of valuable
4:48
data I can find. Oh, absolutely. The Ministry
4:51
of the Economy made a point to highlight what
4:54
was not taken. The attackers could not see the
4:57
actual account balances. Right. That's an important
4:59
distinction. And they could not initiate direct
5:01
transfers or card payments from inside the system.
5:04
Because FICOVA is an index, right? Yeah. It's
5:06
not the bank vault itself. It knows where the
5:08
accounts are, but it doesn't hold the funds.
5:10
Okay. The French Banking Federation confirmed
5:13
that the information stolen is simply not sufficient
5:16
to allow fraudsters to log into a victim's bank
5:19
portal and wire money. money away. So what exactly
5:23
did they get? The specific data points accessed
5:25
across those 1 .2 million accounts included the
5:29
international bank account numbers, so the IBANs.
5:32
Okay, the routing info. Right. Plus the account
5:34
holders' first and last names, their physical
5:36
addresses, and in some cases, their tax identification
5:39
numbers issued by the Directorate General for
5:41
Public Finance, or DGFIC. So what does this all
5:45
mean? If I'm a victim and hearing that they can't
5:47
see my balance or wire my money to an offshore
5:49
account, I mean, that feels like a massive relief.
5:53
It does sound like a silver lining. Yeah, it
5:55
sounds like they broke into the registry but
5:56
didn't actually get the prize. Why should you
5:58
or I be worried about them just knowing my routing
6:00
number and address? Well, the danger lies in
6:03
how the broader financial ecosystem uses that
6:06
specific combination of data to establish trust.
6:09
Think of it this way. While the locked front
6:12
door meaning your account balance and direct
6:14
transfers, is secure, the attacker just grabbed
6:18
the architectural blueprints to the house. Okay,
6:21
that's not good. No, it's not. The attackers
6:24
don't need to log into your bank account if they
6:26
can trick the rest of the financial system into
6:28
pulling the money out for them. Both the French
6:30
Banking Federation and the tax authorities have
6:32
issued stark warnings about how this data is
6:35
weaponized. And how is it weaponized? Primarily
6:38
through direct debit forgery. Wait, a direct
6:40
debit is just what I use to pay my water bill
6:42
or my gym membership. It's essentially auto pay.
6:45
How do you forge that if you aren't the utility
6:47
company? Right. So in the European banking system
6:50
and many others globally, direct debits are built
6:52
on a foundation of systemic trust. A legitimate
6:55
creditor sets up a mandate to pull money from
6:58
your account. Fraudsters exploit this by setting
7:01
up a front company and registering with a payment
7:03
service provider as an authorized debit issuer.
7:06
Armed with your exact IBAN, your full name, and
7:10
your physical address, they literally forge a
7:12
debit mandate. Oh, wow. Yeah. They present this
7:16
mandate to the banking network, which looks at
7:18
the perfectly matching personal data and just
7:21
assumes you have authorized this new company
7:23
to withdraw funds for a service. Here is where
7:26
it gets really interesting. They are weaponizing
7:28
the convenience of auto pay. It's like giving
7:31
a criminal a stack of your blank checks. That's
7:33
exactly what it is. They might not know how much
7:35
is in the account and they can't log in to check,
7:37
but they can keep writing them to pay for their
7:40
own Netflix or electricity until the bank finally.
7:43
notices the signature is faked. Yes. And subscription
7:46
fraud is another major vector here. Fraudsters
7:49
use the stolen I -bands and matching identities
7:52
to sign up for various high -end subscriptions,
7:55
software licenses, or cloud hosting services.
7:58
Stuff they can resell or use themselves. Yeah,
8:00
right. They receive the real usable services.
8:04
And the billing is silently routed to the victim's
8:06
account through those forged mandates. It relies
8:09
entirely on the victim not noticing small recurring
8:12
leaks in their monthly statements. Until the
8:15
victim catches a weird $50 charge from a company
8:18
they've never heard of. But there is a second
8:21
layer to this threat, isn't there? Because the
8:23
physical addresses and the tax identification
8:25
numbers aren't strictly necessary to forge a
8:28
digital subscription. No, they aren't. So what
8:30
is the attacker doing with that specific, highly
8:34
sensitive information? They use it for social
8:36
engineering. Honestly, the psychological threat
8:38
here is arguably more dangerous than the automated
8:41
fraud. Oh, so? Armed with your exact address,
8:44
your name, your tax ID, and your IBAN, an attacker
8:48
can execute a highly targeted phone scam. They
8:51
call you. spoofing the caller ID to make it look
8:53
like your specific bank. I can see exactly how
8:56
this plays out. They start the call by verifying
8:57
my home address and referencing my tax ID. Instantly,
9:00
my defenses are gone because who else would know
9:03
my internal government tax identifier and my
9:06
banking route except the bank's fraud department.
9:09
They build immense credibility in the first 10
9:12
seconds of the call using the stolen registry
9:14
data. Then they pivot to creating a sense of
9:18
panic. They tell you that your account is currently
9:20
under attack, ironically, and that to secure
9:23
your funds, they need you to read back a security
9:25
code they just texted to your phone. But the
9:28
text isn't a cancellation code. No. The attacker
9:31
is sitting at their computer trying to log into
9:33
my actual bank account using my email, and they
9:36
just triggered a two -factor authentication code.
9:38
They are using the panic and the trust they built
9:41
with the FICO beta to make me hand over the final
9:44
key. You are handing them the keys to the vault
9:46
while believing you are locking the door. Yeah.
9:48
It is incredibly manipulative. So how do you
9:51
even defend against that? Well, the French Banking
9:53
Federation has laid out very specific, actionable
9:55
advice for listeners caught up in this exposure.
9:59
First, you have to check your accounts and monitor
10:01
listed transactions weekly. Yet do not wait for
10:04
the monthly statement to arrive in the mail.
10:07
you need to watch direct debit transactions closely
10:09
because European banking rules give you an eight
10:12
-week window to dispute a fraudulent direct debit
10:15
and have the funds reversed without question.
10:18
Eight weeks is a generous window, but if you
10:20
have auto pay set up for a dozen different services
10:23
and you aren't checking line by line, two months
10:26
can fly by. Absolutely. And if you miss that
10:28
window, that money is just gone and you might
10:30
be funding someone's server farm indefinitely.
10:33
Right. And the second critical piece of advice
10:35
is hypervigilance against inbound communication.
10:38
Banks generally do not call you and ask for your
10:41
passwords, your usernames, or your two -factor
10:44
safety codes. Yeah, they just don't do that.
10:46
If someone calls claiming to be your bank, no
10:49
matter how much accurate personal information
10:51
they recite to you, hang up the phone. Look up
10:53
the official number on the back of your bank
10:55
card and call the institution back yourself.
10:57
That is a sobering reminder of how vulnerable
11:00
individuals become when seemingly harmless data
11:03
points like a routing number and an address are
11:05
combined and weaponized. But I want to zoom out
11:09
for a second. OK. Because this level of data
11:11
exposure makes individuals highly vulnerable.
11:14
But zooming out, this breach is actually part
11:17
of a much larger, more troubling trend for the
11:20
French government. It really is. If we connect
11:23
this to the bigger picture, the pattern is hard
11:25
to ignore. We are seeing a rapid fire string
11:28
of cyber incidents hitting French institutions.
11:30
Let's go through the timeline. Just two months
11:33
prior to the FITCOBA exposure, a massive distributed
11:36
denial of service, or DDoS attack, disrupted
11:39
the websites and mobile apps of the French postal
11:42
service, La Poste, and its banking subsidiary,
11:45
La Banque Postale. Okay, so that was just two
11:47
months prior. Right. And around that same time,
11:49
there was a cyber attack that compromised the
11:51
email servers at the French Ministry of the Interior.
11:54
And if we look back to March 2024, there was
11:56
an enormous breach involving France Travail,
11:58
the National Unemployment Agency and CAP employees.
12:01
Yes, exposing 20 years worth of job seeker data.
12:04
We are talking about decades of citizen data,
12:07
email servers at the Ministry of the Interior,
12:10
the Postal Service and now the National Bank
12:12
Account Registry. Are we seeing a coordinated
12:16
siege on French infrastructure or is this just
12:19
the new normal for any government that centralizes
12:21
decades of citizen data? While taking an impartial
12:24
look at this trend, it is vital to see how centralized
12:27
databases like The COBA, which tracks 300 million
12:30
accounts, act as massive honeypots. Honeypots,
12:34
meaning they attract every threat actor out there.
12:36
Exactly. When governments consolidate data to
12:38
make civil services efficient, you know, to make
12:41
tax collections seamless or to streamline welfare
12:43
distribution, they inadvertently create highly
12:46
lucrative targets. So it's not necessarily a
12:48
coordinated political siege, but just criminals
12:50
going where the money is. Right. Decentralized
12:53
data is a nightmare for a civil servant to manage.
12:56
But a breach only affects a small, localized
12:58
segment. Centralized data is wonderfully efficient.
13:01
But a single compromised employee password exposes
13:04
millions of identities across the entire nation
13:07
in a matter of days. It is the ultimate double
13:10
-edged sword. You centralize the architecture
13:12
to make the machinery of government work smoothly
13:15
for the citizen. But in doing so, you put all
13:18
the eggs in one incredibly fragile basket. And
13:21
threat actors don't need to coordinate a grand
13:23
siege. They are simply drawn to the largest repositories
13:26
of data on the board. Right now, centralized
13:28
civil service registries are the biggest prize.
13:31
And the FICOBI incident perfectly illustrates
13:34
that the data itself is the weapon. You don't
13:37
need to crack the encryption on a bank's vault
13:39
to steal money if you have enough administrative
13:41
data to trick the broader system into handing
13:44
the funds to you. So to briefly recap our journey
13:46
today, a civil servant's compromised credentials
13:49
allowed 16 days of unseen access to a massive
13:52
national registry. It proves that you don't need
13:54
to, quote unquote, hack a bank to weaponize 1
13:57
.2 million IBANs and identities. And this raises
14:00
an important question for you to mull over. As
14:03
we move toward increasingly digital and centralized
14:05
lives, is the convenience of having all our financial
14:08
and civic data in one secure government registry
14:11
actually worth the risk of a single compromised?
14:14
password exposing millions. Have we built a digital
14:18
society where the blast radius of human error
14:20
is just too large? That is a lingering thought
14:23
right there. And it brings us to how you navigate
14:26
this exposed digital world. Protecting against
14:29
these kinds of credential -based vulnerabilities
14:31
requires a proactive strategy. You can't just
14:34
rely on the firewall anymore. Exactly. You need
14:36
to monitor the behavior inside your networks.
14:39
If you want to ensure your organization is prepared
14:41
for these modern threats, you need to visit www
14:44
.kinsoft .com .au to discuss your security and
14:48
IT needs. They can help you build systems that
14:51
actively look for anomalies and protect your
14:53
data. The landscape has definitely shifted and
14:56
our defenses have to shift with it. Absolutely.
14:58
Well, that wraps up our discussion. Thank you
15:00
for joining us on Tech Talks with Kinsoft. Remember
15:02
to stay curious and stay secure. We'll catch
15:04
you next time. Thanks for listening.