Stolen Login Behind French Bank Database Breach

A cybersecurity incident in France has exposed the personal data of around 1.2 million bank account holders, and security experts say the method used mirrors attacks targeting Irish organisations every day.

French authorities confirmed that an attacker used credentials linked to a government official to access part of the FICOBA database, a state system containing information on bank accounts held in France. The data accessed includes names, addresses, account identifiers, and in some cases tax identification numbers. Authorities confirmed the access did not allow balances to be viewed or transactions to be carried out.

ESET Ireland, a Wexford-based cybersecurity company and exclusive Irish distributor of ESET, said the incident is a reminder that large-scale data exposures often begin with something far simpler than a sophisticated technical attack.

George Foley, Security Spokesperson, ESET Ireland:

"Most people hear 'bank data breach' and picture a technical break-in. In reality, a lot of these incidents are closer to someone getting hold of the right keys. If an attacker gets a legitimate login, they often don't need to 'hack' anything. They just log in."

While no funds could be moved directly, ESET Ireland warned that the stolen details remain highly valuable to criminals. In an Irish context, data of this kind is routinely used to make scam attempts appear convincing, with fraudsters impersonating institutions such as Revenue, AIB, Bank of Ireland, or An Post to pressure people into acting quickly.

George Foley:

"Even where money can't be moved directly, the details are still valuable. They help criminals sound convincing. That's when you get the 'we need to verify you' calls, the fake security emails, and the pressure to act fast."

Irish consumers are advised to be cautious of unsolicited calls, texts, or emails claiming to be from their bank or a government body, particularly those requesting personal details or urgent action. When in doubt, hang up and call the organisation directly using a number from their official website.

ESET Ireland said organisations should treat account security as a frontline control, with strong authentication, tighter access restrictions, and proper monitoring for unusual activity, particularly in systems accessed by large numbers of staff.

Further information is available at www.eset.com/ie.