France’s digital administration agency confirmed on May 4, 2025, the Tchap breach was reported, involving a compromised user account rather than an event on June 8, 2026. An attacker hijacked a single user account and used it to pull data from tens of thousands of government accounts before investigators shut the access down.
The agency, DINUM (Direction interministérielle du numérique), said 73,467 of the more than 825,000 registered Tchap agents were affected, a figure it published alongside a notice to France’s data protection regulator, CNIL. A hacker using the handle “Misère” separately claimed to have taken hundreds of thousands of messages and tens of thousands of files, numbers DINUM has not confirmed.
The breach lands at an awkward moment for Europe’s push toward digital sovereignty, the effort to build homegrown alternatives to Slack, Microsoft Teams, and WhatsApp. Tchap runs on Matrix, the open messaging protocol that a growing list of European governments have adopted specifically because it promises more control than American cloud platforms. Now the highest-profile Matrix deployment in government has a breach notice attached to its name, and DINUM’s investigation is still open four days after the first disclosure.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Timeline: How the Tchap Breach Unfolded
The breach played out over roughly 36 hours, based on DINUM’s public account of events.
On May 4, 2025, an attacker compromised a Tchap user account through what DINUM called an “usurpation de compte,” an account takeover achieved by hijacking legitimate login credentials rather than breaking Tchap’s underlying software. The stolen account began sending requests that DINUM’s security team flagged as malicious activity.
By June 8, DINUM says it had identified the account behind the malicious requests and blocked it, cutting off the attacker’s persistent access. The agency worked in coordination with ANSSI, France’s national cybersecurity agency, to analyze the incident. DINUM then notified CNIL, the country’s data protection authority, because the attacker may have viewed personal data during the window of access. The agency also messaged Tchap’s user base directly, reminding agents that public discussion rooms are open by design and carry no encryption.
The investigation DINUM opened afterward is still running as of this writing. Forensic teams are working through event logs to map exactly which conversations the attacker reached and what, if anything, left the system. DINUM has not set a public deadline for that review.
Inside Tchap: France’s Matrix-Based Government Messenger
Tchap is the instant-messaging tool built for French civil servants, run by DINUM as part of a broader suite of government collaboration software called LaSuite. It isn’t a custom-built platform from scratch. Element, the UK company that develops the leading Matrix client, describes Tchap as a fork of its own software, adapted for the French state.
Matrix is an open, federated messaging protocol, similar in spirit to email: anyone can run a server, and servers can talk to each other. That architecture appealed to European governments looking to cut dependence on Slack, Microsoft Teams, or WhatsApp, all controlled by US companies subject to US law. Element’s own published customer materials credit the French government as the first large-scale government adopter of Matrix, and the company puts Tchap’s daily user count above 350,000, a separate figure from DINUM’s own count of more than 825,000 registered agents.
Matrix supports end-to-end encryption, but the protocol doesn’t apply it everywhere automatically. Individual rooms can be configured as encrypted or open, and Tchap’s public discussion forums, by design, fall into the open category. That distinction turned out to matter a great deal once the breach happened.
The Numbers: What DINUM Confirmed vs. What the Attacker Claims
Two very different sets of numbers are circulating about this breach, and mixing them together is the easiest way to get the story wrong.
DINUM’s official figures are narrow and specific: 73,467 affected agents out of more than 825,000 registered, or under 9% of the total user base. The agency has not published a count of exposed messages, files, or rooms, and says that work is still underway.
Separately, a hacker using the alias “Misère” told reporters at SecurityWeek and other outlets a much larger story: claims of roughly 643,459 messages taken, along with 59,386 files totaling about 13.5GB, pulled from somewhere between 876 and 976 discussion rooms depending on which report you read. None of those figures come from DINUM, and the agency’s own statement stops well short of confirming them.
The table below separates what French officials have verified from what remains an unproven claim.
| Metric | Figure | Source | Status |
|---|---|---|---|
| Registered Tchap agents | 825,000+ | DINUM | Confirmed |
| Agents affected by breach | 73,467 (under 9%) | DINUM | Confirmed |
| Daily active Tchap users | 350,000+ | Element | Vendor-reported |
| Messages allegedly exposed | ~643,459 | “Misère” hacker, via SecurityWeek | Unverified claim |
| Files allegedly exfiltrated | 59,386 files (~13.5GB) | “Misère” hacker | Unverified claim |
| Discussion rooms allegedly accessed | 876-976 (conflicting reports) | “Misère” hacker | Unverified claim |
| Attacker account status | Identified and blocked | DINUM | Confirmed |
| CNIL notified | Yes | DINUM | Confirmed |
How the Attacker Got In: Account Hijacking, Not a Broken Protocol
DINUM has been careful about one distinction: this wasn’t a cryptographic failure in Matrix. It was a compromised login.
The agency’s statement describes the entry point as account takeover, without naming the specific technique used to get there. BleepingComputer’s reporting frames it the same way: a valid account, not a broken encryption scheme, gave the attacker a foothold. Common causes of this kind of takeover include phishing, credential stuffing against reused passwords, or session token theft, but DINUM hasn’t said which applied here.
What the attacker could see once inside depended heavily on Matrix’s room-level encryption model. In the Matrix specification, a room only becomes end-to-end encrypted when it carries a specific state event, called m.room.encryption, set at the room’s creation. A simplified version of that event looks like this:
{
"type": "m.room.encryption",
"state_key": "",
"content": {
"algorithm": "m.megolm.v1.aes-sha2"
}
}Private conversations between Tchap agents carry that event and stayed protected, according to DINUM. Public discussion rooms don’t, by design. Anything posted there was visible to whoever held the compromised account, no different than any other logged-in user browsing an open forum.
Who Is “Misère”? What’s Known About the Attacker
Little is public about the person or group behind the “Misère” handle. SecurityWeek’s reporting is the main source connecting that name to the Tchap incident, describing a hacker who reached out to journalists with claims about the scale of the breach.
DINUM’s own statements don’t name or describe an attacker, sticking to what its investigators can verify: a compromised account, a blocked login, and an ongoing log review. That gap between an attacker’s public claims and an agency’s confirmed findings shows up constantly in breach reporting, and it cuts both ways. Attackers often inflate numbers to draw press attention or pressure a victim into paying. Agencies, for their part, have an incentive to hold back on scope until forensics are complete.
Readers should treat the 643,459-message figure as a claim under review, not a settled fact, until DINUM’s log analysis either confirms or narrows it.
DINUM’s Response: Containment, CNIL Notification, and the Ongoing Investigation
DINUM’s public statement, posted on the government’s own site, lays out the sequence in plain terms. Translated from the original French, the agency wrote that on June 7, 2026, a Tchap user account, the French state’s encrypted instant messaging service, was compromised following an account takeover, an incident reported and analyzed in coordination with ANSSI, according to DINUM’s official incident page.
In English-language comments carried by BleepingComputer, DINUM described the containment step directly: “At this stage, the account originating the malicious requests has been identified.” The agency added that “it was immediately blocked to remove the attacker’s persistent access and allow for a thorough analysis of the data they were able to access,” according to DINUM, quoted by BleepingComputer.
On the state of the forensic work, DINUM said: “The investigation continues, including the study of event logs, to identify the conversations that the attacker was able to access and the nature of the exfiltrated data,” per the same BleepingComputer report.
DINUM confirmed the scope of the breach directly to SecurityWeek: “Of the more than 825,000 registered agents, 73,467 are reportedly affected by this incident, representing less than 9% of registered users,” the agency said, according to SecurityWeek’s coverage.
Notifying CNIL was a legal step, not a courtesy. Under French and EU data protection rules, an agency that suspects personal data exposure has to inform the regulator without undue delay, and DINUM did so in the same window it disclosed the breach to the public.
Why Public Rooms Weren’t Encrypted: A Design Choice Under Scrutiny
The split between public and private rooms isn’t a bug. It’s how most large-scale chat systems work, Matrix included. A room open to an entire organization, where anyone can search and join, can’t easily support end-to-end encryption for every member without also making key management extremely heavy.
DINUM leaned on that distinction hard in its public messaging after the breach. According to the agency’s official incident notice, Tchap’s discussion forums are open to all users by design and carry no encryption, while private, one-to-one and small-group conversations stayed protected throughout the incident.
The problem is one of expectation, not just architecture. Government employees using a tool branded as the state’s encrypted instant messaging service may not draw a sharp mental line between a protected direct message and an open forum post. Security researchers have flagged this exact gap in other federated and hybrid-encryption chat tools for years. Tchap’s incident now gives it a fresh, well-documented example.
Historical Context: Government Messaging’s Recurring Security Problem
Tchap isn’t the first government messaging tool to have a bad year. Two recent incidents make the pattern clear.
Signalgate: When a Journalist Joined a War Cabinet’s Chat
In March 2025, The Atlantic’s editor Jeffrey Goldberg revealed he had been added to a Signal group chat used by senior US national security officials to plan airstrikes against Houthi targets in Yemen. The chat, reported publicly on March 24, 2025, included Vice President JD Vance, Defense Secretary Pete Hegseth, Secretary of State Marco Rubio, CIA Director John Ratcliffe, Director of National Intelligence Tulsi Gabbard, White House Chief of Staff Susie Wiles, and National Security Adviser Mike Waltz, 18 participants in total. Signal itself was never compromised. The failure was procedural: sensitive military planning ran through a consumer app instead of a classified government system, and someone added the wrong person to the group.
The TeleMessage Breach: When Archiving Became the Weak Point
Two months later, TeleMessage, a company whose modified version of Signal is used by US agencies to archive official communications for compliance, suffered its own breach. On May 4, 2025, 404 Media reported that a hacker had pulled data straight from the company’s servers through an exposed Spring Boot Actuator heapdump endpoint, a known class of misconfiguration. The exposure reportedly included plaintext usernames, passwords, chat logs, and encryption keys. Researchers later tied the incident to two CVEs, CVE-2025-48927 and CVE-2025-47729. Unlike Signal itself, TeleMessage’s archiving layer stored messages in a form that defeated the point of end-to-end encryption altogether.
Set against that backdrop, Tchap’s breach fits a broader theme. The messaging apps themselves keep holding up under scrutiny, while the account security and configuration choices layered around them keep failing.
Competitive Comparison: How Tchap Stacks Up Against Other Secure Messengers
Comparing Tchap to consumer and enterprise alternatives shows the tradeoffs government IT teams weigh when they pick a messaging platform.
Signal offers end-to-end encryption on every message by default and has built its entire reputation on that guarantee, but it’s a centralized, US-based service with no equivalent of Tchap’s public government forums. WhatsApp, built on the same underlying Signal Protocol, encrypts by default too, but Meta owns and operates it outside any government’s direct control, which is precisely what pushed France and other EU states toward Matrix in the first place. TeleMessage shows the opposite failure mode: encryption in transit, undone by a poorly secured archive on the back end.
Tchap and other Matrix deployments split the difference. They give administrators fine-grained control over which rooms are encrypted, which is powerful for an organization with hundreds of thousands of users and a mix of sensitive and casual conversations. That flexibility puts more responsibility on configuration and account security than a blanket, always-on encryption model does.
| Platform | Underlying Protocol | Default Encryption | Primary Users | Notable 2025-2026 Security Incident |
|---|---|---|---|---|
| Tchap | Matrix (Element fork) | Private rooms encrypted, public rooms open by design | French civil service, 825,000+ registered agents | Account hijacking breach, June 2026 (73,467 accounts) |
| Signal | Signal Protocol | End-to-end, all chats, always on | Consumer, informal use by some officials | Signalgate chat exposure, March 2025 (app itself not breached) |
| Signal Protocol | End-to-end, all chats, always on | Global consumer messaging (Meta) | No 2025-2026 protocol-level breach identified in this research | |
| TeleMessage (TM SGNL) | Modified Signal Protocol plus archiving layer | Encrypted in transit, archived in plaintext | US federal agencies (compliance archiving) | Server breach exposing plaintext messages, May 2025 (CVE-2025-48927, CVE-2025-47729) |
| Other Matrix/Element deployments | Matrix | Configurable per room, opt-in E2EE | European public-sector pilots (EU Commission, Germany, Sweden, Belgium, Greece, per Element) | Same architecture and risk profile as Tchap |
Market Impact: A Test for Europe’s Digital Sovereignty Push
Tchap isn’t a public company, so there’s no stock price to move. The real market at stake is procurement, the slow, high-stakes process by which governments decide which vendors and protocols to trust with official communication.
Element, the company behind the Matrix client Tchap is built on, has spent the past few years building a public case that Matrix is the answer to Europe’s dependence on American cloud platforms. By Element’s own published account, the French government was the first large-scale government adopter of Matrix, and the company lists a long roster of other public-sector customers across the continent. That roster includes a European Commission trial for resilient, sovereign communications, Luxembourg’s digitalisation ministry, Sweden’s Försäkringskassan, Germany’s federal BundesMessenger program and a Bundeswehr-linked messenger effort, Belgium’s BEAM service, Greece’s GRNET, and NATO ACT’s Ni²CE Messenger.
That’s a lot of institutional weight resting on one protocol, which means Tchap’s breach doesn’t stay contained to France. Procurement officers evaluating a Matrix-based deployment anywhere in Europe now have a concrete, recent incident to point to on both sides of the argument. Proponents can note that Matrix’s encryption held up and only an account got hijacked. Skeptics can note that a flagship deployment with 825,000 registered users still let an attacker walk through the front door.
Expect the incident to show up in procurement slide decks on both sides of that debate for a while. For more on the ransomware, breach, and zero-day trends shaping this year, see tech-insider.org’s cybersecurity threats hub.
Identity Is the New Perimeter: What the Data Says
Strip away the Matrix-specific details, and Tchap’s breach is a textbook identity attack. One set of valid credentials, misused, no exploit required.
That pattern lines up with the broader trend security teams have been tracking all year. A tech-insider.org analysis of Verizon’s 2026 Data Breach Investigations Report found that exploited vulnerabilities had overtaken stolen credentials as the single largest breach vector, at 31%, though credential and identity-based attacks still account for a large share of total incidents industry-wide, a pattern Verizon’s own DBIR has tracked for years. Attackers increasingly don’t need a zero-day. They need one employee’s password, one reused login, or one stolen session token.
That’s also why multi-factor authentication and hardware security keys keep coming up in post-breach recommendations. DINUM hasn’t published technical details on the authentication method behind the compromised Tchap account, but the incident adds to a growing pile of cases where the cheapest fix, stronger login protection, would have mattered more than any amount of encryption strength on the back end.
Practical Fallout: What Security Teams Should Take From This
Government IT and security leads elsewhere can pull a few concrete lessons out of this incident, even without knowing every technical detail DINUM is still investigating.
Treat public and semi-public chat rooms in any Matrix-based or similarly architected tool as unencrypted by default, and train users accordingly. Prioritize account-takeover defenses, phishing-resistant multi-factor authentication, session monitoring, and anomaly detection over encryption upgrades, since the entry point is almost always a login rather than a broken cipher. Build a CNIL-style notification path before an incident happens, not during one. DINUM’s fast regulator notification limited the legal fallout even as the technical investigation continued.
Two tech-insider.org guides cover the practical side of that second point directly: setting up passkeys to remove passwords from the equation entirely, and configuring a YubiKey for hardware-backed multi-factor authentication. Neither is a silver bullet, but both close the exact gap that a compromised-account breach like Tchap’s depends on.
What Happens Next: Five Predictions
Based on how DINUM has handled the incident so far, and how similar breaches have played out elsewhere, here’s what’s likely over the next several months.
- DINUM tightens authentication requirements across Tchap. Expect a push for stronger login protection, and possibly hardware-backed MFA, for accounts with access to sensitive rooms, following the pattern other agencies have set after account-takeover incidents.
- CNIL’s review produces a public finding. Given DINUM notified the regulator promptly, a formal CNIL response, whether a clean bill of health or a set of required fixes, should land within months rather than years.
- Other European Matrix deployments face fresh security audits. With Element publicly linking Tchap to a wider network of government customers, expect Luxembourg, Sweden, Germany, and Belgium’s IT departments to quietly recheck their own account security controls, breach or not.
- Element and the Matrix ecosystem push clearer default warnings for unencrypted rooms. The gap between “encrypted messaging app” branding and unencrypted public forums is exactly the kind of user-facing confusion that tends to get fixed with a UI change after an incident like this.
- Copycat claims follow. High-profile breach coverage tends to draw opportunistic actors who claim credit or threaten to leak data they don’t actually have, and the attention on the “Misère” persona makes that more likely here, not less.
Frequently Asked Questions
What is Tchap?
Tchap is the instant messaging app built for French civil servants, developed by DINUM on Matrix and Element’s open-source software. It has more than 825,000 registered accounts and, according to Element, over 350,000 daily users.
How many accounts were affected by the Tchap breach?
DINUM confirmed 73,467 agent accounts were affected, out of more than 825,000 registered, or under 9% of the total user base.
Was Tchap’s encryption broken in this attack?
No. DINUM’s account of the incident describes a compromised user login, not a flaw in Matrix’s encryption. Private, encrypted conversations were not affected. The exposure was limited to public discussion rooms, which are unencrypted by design.
Who is behind the Tchap hack?
A hacker using the alias “Misère” has claimed responsibility in comments to reporters, according to SecurityWeek. DINUM has not named or confirmed the identity of the attacker.
Did France’s government confirm how many messages were leaked?
No. The widely cited figure of roughly 643,459 messages comes from the attacker’s own claims, not from DINUM. The agency says its log review is still underway.
Has France’s data protection regulator gotten involved?
Yes. DINUM notified CNIL, the French data protection authority, because personal data may have been exposed during the attacker’s window of access.
Is Matrix, the protocol behind Tchap, safe to use for government communication?
Matrix’s end-to-end encryption for private rooms was not compromised in this incident. The risk exposed here was account security and the distinction between encrypted and open rooms, a configuration and identity problem more than a protocol one.
How does Tchap compare to Signal or WhatsApp for security?
Signal and WhatsApp apply end-to-end encryption to every conversation by default. Tchap and other Matrix deployments allow administrators to mix encrypted and unencrypted rooms, which offers more flexibility but shifts more responsibility onto configuration and account security.
Related Coverage
- Signal vs WhatsApp vs Telegram: 1 Skips Default E2EE [2026]
- Verizon DBIR: Exploits Overtake Credentials at 31% [2026]
- 24 Billion Credentials Leaked in Record Data Dump [2026]
- How to Set Up Passkeys: 13 Steps, 90 Min [2026]
- How to Set Up a YubiKey: 13 Steps, 60 Min [2026]
- Spectrum Data Breach: 4.9M Confirmed, 42M Claimed [2026]
