Multiple French govt institutions’ emails, passwords exposed, hackers claim
Multiple emails and passwords attributed to numerous France-based organizations and institutions were posted on a dark web forum run by a prominent ransomware cartel.
Image by Cybernews.
Multiple emails and passwords attributed to numerous France-based organizations and institutions were posted on a dark web forum run by a prominent ransomware cartel.
The dataset was posted by the Stormous ransomware cartel, with attackers claiming it’s a “comprehensive leak” from “high-profile French government organizations.” The Cybernews research team investigated the claims, concluding the supposed leak did include some data, albeit of questionable quality.
For one, while the leaked data appears to come from high-profile French government institutions, the passwords are hashed using an outdated MD5 algorithm, deemed weak by numerous security researchers.
“That said, this could also be an old dataset from a time when stronger security standards weren’t yet in place,” researchers said.
More from Cybernews
Sainsbury’s installs more facial rec tech in stores: Should shoppers be worried?
"Phantom squatting” uses AI hallucinated domains for cyber attacks
What they’re doing to gamers is a robbery in broad daylight
Irish parliament expands Microsoft use, despite the EU’s efforts to ditch it
Can government AI actually scrub UAP footage from the internet?
The EU and Apple CEO Tim Cook held "constructive" talks after their Siri AI dispute in Europe
If that were the case, attackers could utilize the data for convincing phishing campaigns. For example, attackers could use the email to impersonate government agencies and demand additional details or even financial information.
“And if threat actors manage to crack the hashes, it could give them access to some of these organizations’ systems — especially if credentials are reused or poorly secured,” the team said.
According to the team, some prominent organizations are listed in the dataset, including:
- Agence Française de Développement (French Development Agency)
- Agence Régionale de Santé Ile-de-France (Regional Health Agency of the Paris Region)
- Allocations familiales (Family Allowance Fund or Family Benefits Office)
- Cour des comptes (Court of Audit or Court of Accounts)
- Caisse Régionale de Crédit Agricole Mutuel Loire Haute-Loire Société coopérative (regional bank belonging to the Credit Agricole Group)
The volume of exposed email addresses greatly varies from organization to organization, with some having several emails exposed, while hackers claim others had hundreds of email addresses revealed.
We reached out to the French Cybersecurity Agency (ANSSI) for comment and will update the article once we receive a reply.
Last year, Cybernews wrote about an exposed instance that contained 95 million records belonging to French citizens, including phone numbers, email addresses, and partial payment information.
Meanwhile, the Stormous ransomware group was first identified in 2022, making the gang one of the older players in the field. For example, last year the gang claimed an attack on the Belgian brewer Duvel Moortgat.
According to Cybernews’ dark web tracker Ransomlooker, the gang has victimized at least 34 organizations over the last 12 months.
