A security breach has hit Tchap, the French government’s encrypted messaging platform widely used by civil servants, following the country's restriction on foreign apps like WhatsApp and Signal for official communication. Authorities are now investigating not only this incident but also whether a larger volume of messages and user data was also exposed.
Tchap is an instant messaging service and collaboration tool developed by DINUM, the digital affairs directorate of the French government, and ANSSI, France’s cybersecurity agency.
It’s a fork of the secure chat application Riot and can only be used by people with a .gouv or similar email address. Tchap currently has over 300,000 monthly users and has over 500,000 downloads on the Google Play Store.
To strengthen digital communication, Prime Minister François Bayrou mandated the use of Tchap for work-related communications for all civil servants in August 2025 and banned foreign messaging apps, such as WhatsApp and Signal.
On June 7th, 2026, ANSSI detected a security breach on the government’s encrypted messaging platform. According to the cybersecurity agency, the attacker used a compromised user account to gain access to Tchap.
ANSSI states that private conversations conducted via Tchap are encrypted and secured. Public conversations, on the other hand, are accessible to all users and aren’t encrypted. To remind users of this, a message was sent to all Tchap users.
The attacker may have gained access to personal data shared by users in conversations with the hacked account. Therefore, DINUM notified the French privacy supervisor and data protection authority, CNIL, of the security incident.
Meanwhile, a threat actor called “misere” claims to have stolen data from Tchap.
In a post on the dark web, he claims to have obtained access through social engineering and exfiltrated 13.5GB of data. Allegedly, the stolen data includes 73,467 user accounts, 643,459 messages, 876 chat rooms with message history, and 59,386 shared media files.
Furthermore, the threat actor is said to have accessed discussion rooms involving personnel from multiple French ministries.
DINUM reports that the investigation into the incident is still ongoing, as is the investigation into which data the attacker had access to.
Unlock more exclusive Cybernews content on YouTube.
Your email address will not be published. Required fields are markedmarked