Search

Cerfia, citing French breaches, listed the administrations, state services, and French public operators that may have been targeted by cyberattacks or data leaks over the past year. In the employment and social benefits sector, Cerfia reported data concerning up to 12 million employees in the URSSAF/DPAE system: names, dates of birth, employers, and hire dates. For URSSAF/Pajemploi, the figure was 1.2 million employees, with identities, addresses, social security numbers, and bank names. The census also mentioned 1.6 million young people linked to France Travail and local missions, whose identities, addresses, phone numbers, and social security numbers may have been affected. For Pass'Sport and the Ministry of Sports, it mentioned 3.5 million households along with their names, contact details, phone numbers, and addresses. It also reported nearly 1.2 million CAF/CNAF/Vacaf files claimed, without confirmation from CNAF, regarding family information, beneficiaries, and vacation stays. Cerfia also reported that Bloctel/DGCCRF had about 3 million phone numbers extracted, including 600,000 registered on Bloctel. The Agency for Services and Payment and the Coup de pouce énergie scheme may have involved 108,555 beneficiaries, with their identities, addresses, amounts of assistance, and IBANs. A link mentioned in the post referred to a service that may have affected 550,000 accounts, with names, emails, phones, dates of birth, and engagement histories. France Travail may also have been affected by agent data held by an HR service provider, while France VAE may have seen candidate data targeted. In education and training, the census reported 5.8 million DELF-DALF candidates associated with France Éducation International and GAEL, whose identities, nationalities, dates, and places of birth may have been exposed. For the Ministry of National Education, it mentioned up to 4.35 million teachers potentially affected by identity, assignment, grade, and compensation data, as well as one million students from Créteil whose personal and family data may have been exfiltrated. The COMPAS system may have involved 243,000 agents, with their names, personal addresses, and initial assignments. Up to 200,000 candidates for Ev@lang may have been affected by personal data related to language tests. Cerfia also cited ÉduConnect. The post mentioned 705,000 Parcoursup candidates in the academic region of Occitanie, whose identities, contact details, school information, scholarship status, and family data may have been affected. The intrusion was dated to October 2025. For the Ministry of Sports and FORÔMES, it advanced 450,000 candidates and identity, address, phone number, date of birth, and diploma level data. The Compte Asso was also among the mentioned services. Cerfia further reported at least 30 affected sports federations — notably in football, shooting, tennis, gymnastics, swimming, sailing, skiing, and handball — with data from license holders, including minors. At least eight public higher education institutions were cited: Angers, Lille, UMLP, Alfort, Bordeaux Sciences Agro, AgroParisTech, CNAM, and ésam. The post also mentioned the training platform of the Agency for Civic Service and the application platforms of Campus France. Among financial and administrative organizations, Cerfia reported that about 1.2 million bank accounts linked to DGFiP/FICOBA may have been affected, with identities, addresses, RIBs, and IBANs. Up to 433,485 individuals may have been impacted through the DGFiP property register, with addresses and characteristics of real estate. More than 350,000 individuals may have been affected by tax data — reference tax income, family quotients, and withholding rates — and the portal for vacant inheritances was also listed. For DGAFP/Choosing Public Service, the figure mentioned was 377,418 candidates, with their identities, contact details, diplomas, and professional backgrounds. The post also cited the Ministry of the Interior and the TAJ, FPR, SIA, and SIV files. The census mentioned 774,000 people linked to Cnous/CROUS, with identities, emails, and appointments. It also reported 329,000 extracted documents concerning 139,000 individuals, including identity and income verification documents. ANFR/Radiomaritime may have concerned 330,000 users and their identities, addresses, emails, phones, and dates of birth. For INSEE, Cerfia reported 12,800 agents and former agents, with identities and professional contact details. The Institute for Research and Development may have involved about 7,500 individuals, with identity, address, and professional data along with, for some, social security numbers; exfiltration was not confirmed. The post also cited CNRS and personnel data. Cerfia indicated that Public Health France and a service provider may have been involved for about 80,000 contacts: names, emails, addresses, and professional phones, without any reported medical data. For Tracfin and a support provider, it mentioned 136 professionals, their identities and contact details, as well as 213 assistance requests; according to ANSSI, no suspicion declarations were reported. ANSSI and its innovation laboratory were also listed, with 118 Metabase accounts potentially affected by a compromise. The post further cited 70,000 files and 160,000 administrative documents that may have been exfiltrated from DINUM/HubEE, some containing personal data, as well as the State Cloud. More than 30,000 individuals may have been affected by directory, identity, and professional contact data related to AEFE/Orion. At the Ministry of Ecological Transition, 22,000 agents and accredited organizations may have been involved with access to personal data, and over 300 email accounts may have been compromised. Cerfia also mentioned messaging services and a server from the General Directorate of Customs and Indirect Rights, as well as Tchap, the secure messaging service of the State. Finally, the census reported 14 SDIS targeted, with personal and professional data, internal documents, and medical data. At least five hospital establishments may have been affected: AP-HP, Hospices Civils de Lyon, as well as the establishments in Perpignan, Chaumont, and Haute-Comté. The list also included the French Office for Biodiversity and hunting permits, the National Library of France, and the Center for National Monuments through a ticketing service provider, regional health agencies and vaccination data, as well as the French Office for Immigration and Integration and an IT service provider. #Cyberattaques #ProtectionDesDonnées #SécuritéInformatique (translated)

Abdou Fall indicated that PASTEF had requested the opening of parliamentary inquiry commissions on five cases: Petrotim-Kosmos, the ten-year plan to combat flooding, the special funds of the Prime Minister's office, the HCCT and the CESE, ASER and Intermac, as well as the Ministry of Health. https://t.co/58Un7D4836 #Politique #Enquête #Transparence (translated)

Press Briefs reported that Evan, 15 years old, had his hand blown off by a grenade thrown by law enforcement on Monday in Lens, during a high school mobilization. The media indicated that the prosecutor initially claimed that the teenager had picked up the grenade, a version relayed by several major media outlets, including continuous news channels, but Evan denied it. According to Press Briefs, witnesses had challenged this version from the first day to the local radio Ici, formerly France Bleu. They reportedly said that the grenade exploded near Evan without him having picked it up. The media also indicated that the teenager's mother had filed a complaint for her son's injuries. Press Briefs questioned the media treatment given to the version from the prosecutor or the police when it serves as the main source of a narrative. The media added that earlier in the week, it had questioned a journalist from a major national channel in charge of police-justice cases about a framing based solely on police sources despite contradictory witness testimonies. According to Press Briefs, the journalist did not respond. #Lens #Evan #Médiatique (translated)

substituting more final exams for continuous assessment to base files and selection in higher education on an objective and national basis. The rapporteur of the law that created Parcoursup in 2018, the Renaissance presidential candidate, Gabriel Attal, agreed on the need to "evolve" the system, particularly wishing to "substitute more final exams for continuous assessment to base files and selection in higher education on an objective and national basis." #Parcoursup #Education #Lycéens (translated)

Éloïse Coulombe said she was proud of her group and believed that labels mattered less than the results for citizens. She indicated that her group would collaborate with Mayor Marchand and his team on issues aimed at concretely improving the lives of residents. https://t.co/pvprUTQzrJ #Tribu #Citoyens #Collaboration (translated)

Patrick Kabengele relayed remarks attributed to Finance Minister Doudou Fwamba, stating that political cabinets were temporary, while the public administration ensured the continuity of the State. He indicated that it preserved institutional memory, technical expertise, and mastery of procedures, and that in its absence, government changes risked causing a costly and paralyzing loss of organizational memory. #Politique #AdministrationPublique #État (translated)

NEW files in the series THE OPEN NOTEBOOKS of Health Practices 💼 Social isolation is not a fatality: how to take concrete action in our territories? 🤝 In France, 11% of people have no social network, and 35% of 18-24 year-olds report feeling often or always lonely. However, only 3% of isolated individuals seek help on their own. In the face of this major public health issue, the new issue of the Open Notebooks of Health Practices, written by Daniel Oberlé, offers a methodical framework for field actors: 🔹 Distinguish between isolation and solitude to better target interventions 🔹 Activate everyday places (businesses, third places, associations) as relational infrastructures 🔹 Adopt a proactive approach of "going towards" 🔹 Structure local action in 7 key steps 🎬 Find our complete decoding video on the Health Practices channel to discover the levers for action and field feedback. 🔗 Watch the video and consult the source document: [Audio/Video Capsules of Health Practices 🎙️🎥 https://www.youtube.com/watch?v=XTJnc9GVxBw Consult the document: https://www.pratiquesensante.com/blog/actualites-17/les-cahiers-ouverts-de-pratiques-en-sante-5998 #SocialLink #PublicHealth #SocialAction #Prevention #Territory #MedicalSocial #HealthPractices https://www.pratiquesensante.com/blog/actualites-17/les-cahiers-ouverts-de-pratiques-en-sante-5998 #LienSocial #SantéPublique #ActionSociale #Prévention #Territoire #MédicoSocial #PratiquesEnSanté (translated)

NEW files in the series THE OPEN NOTEBOOKS of Pratiques en Santé 💼 Social isolation is not a fatality: how can we take concrete action in our communities? 🤝 In France, 11% of people have no social network, and 35% of 18-24 year olds report feeling often or always alone. However, only 3% of isolated individuals seek help on their own. Faced with this major public health issue, the new file from the Open Notebooks of Pratiques en Santé, written by Daniel Oberlé, provides a methodical framework for field actors: 🔹 Distinguish isolation from solitude to better target interventions 🔹 Activate everyday places (stores, third places, associations) as relational infrastructures 🔹 Adopt a proactive “go towards” approach 🔹 Structure local action in 7 key steps 🎬 Watch our complete analysis video on the Pratiques en Santé channel to discover the levers of action and field feedback. 🔗 Watch the video and consult the source file: [Audio/Video Capsules from Pratiques en Santé 🎙️🎥 https://www.youtube.com/watch?v=XTJnc9GVxBw Consult the file: https://www.pratiquesensante.com/blog/actualites-17/les-cahiers-ouverts-de-pratiques-en-sante-5998 #SocialLink #PublicHealth #SocialAction #Prevention #Community #MedicalSocial #PracticesInHealth https://www.pratiquesensante.com/blog/actualites-17/les-cahiers-ouverts-de-pratiques-en-sante-5998 #LienSocial #SantéPublique #ActionSociale #Prévention #Territoire #MédicoSocial #PratiquesEnSanté (translated)

The beauty island account reported having taken an intimate moment in its bathroom on Thursday morning, before showering and getting dressed. It described this moment as a break before a day of meetings, files, and colleagues, and wrote that there were only two days left before the weekend. It added that its desire would be even more pressing on Friday night. #SelfCare #JeudiPussy #WeekendEnVue (translated)

"It's a system that is understandable and incomprehensible at the same time. Some schools want the best, but I have friends with good records who have been accepted nowhere. And even the teachers say it: when you come from certain high schools, you can be disadvantaged," Rayan laments again. #ViolencesPolicières #Lycéens #Mobilisation (translated)

Max von Kreyfelt criticized Cora van Nieuwenhuizen's transition from the ministry to Energy-Nederland. He wrote that Van Nieuwenhuizen was appointed as chair of the industry association on August 31, 2021, and that same day she resigned as a minister. She started working for the organization on October 1. According to Von Kreyfelt, Van Nieuwenhuizen had already informed Prime Minister Mark Rutte on July 23 that she would be nominated, but she remained a minister until the end of August. He wrote that Rutte later acknowledged that government officials had access to cabinet documents and could possibly gain information about the area of their future positions. On August 26, Rutte concluded, according to Von Kreyfelt, that the appointment did not go well with the ministry. Arrangements were made to transfer files that could affect her new position to a colleague if necessary. Von Kreyfelt also reported that Energy-Nederland praised her managerial experience in the Netherlands and Europe. He stated that the transition raised questions about the closeness of public positions and private interests, but wrote that the matter in itself did not prove corruption. He advocated for independent assessment of subsequent positions, more transparency regarding contacts, and a mandatory waiting period before former government officials began working in a sector organization. According to him, public experience should not automatically grant access to private influence. https://t.co/V2P6pFuNy1 #Energie #Overheid #Transitie (translated)

Seydi Ba asked the prefect on what basis he considered minors to be involved, whether he had consulted their criminal records and on what grounds. He also asked if they had been convicted and if, failing that, the presumption of innocence was still recognized for them. Ba stated that summoning parents to remind them of their obligations was the responsibility of the prosecutor and not the prefect, adding that the presence of the public prosecutor did not change this prerogative. He believed that the priority given to communication relegated the separation of powers to the background. #Justice #DroitsDesMineurs #SéparationDesPouvoirs (translated)

Press reports indicated that Ségolène Royal had shared a video showing a Black child handcuffed and unconscious between two police officers. Royal questioned the legal basis for handcuffing children and accused the Macronist government of having handcuffed children and strangled a 14-year-old girl while leaving tens of thousands of cases involving pedocriminals unresolved. She also asked why sexual aggressors were not handcuffed when parents, children, or women came to report them at the police station, and expressed that the whole world was watching in dismay at what France had become. #France #Société #Justice (translated)

The author indicated that the New York Post published an article on the Varginha case on Saturday, October 3, 2026, often presented as the "Brazilian Roswell." He added that a former Brazilian minister had asked the United States to declassify their files on extraterrestrials with shining red eyes. https://t.co/cKN9rhEXdh #Varginha #Aliens #Déclassification #BR #US (translated)

IRAN: MEK/NCRI – when AI impersonated a real activist in live conversations For years, synthetic media has largely meant fabricated images, cloned voices and manipulated video. A case uncovered by Anthropic in September 2026 suggests a more consequential development: artificial intelligence being used not merely to imitate how a person looks or sounds, but to behave as that person in an ongoing conversation. Anthropic says it dismantled a distributed influence operation targeting Iranians inside the country and abroad that it linked to the People’s Mojahedin Organization of Iran, or PMOI/MEK, and its political front, the National Council of Resistance of Iran. The operators used a shared AI-agent platform to support impersonation, audience profiling, coordinated social-media activity, synthetic personas and the laundering of organisational content through apparently independent accounts. At least four people involved in the operation worked for official NCRI media outlets, according to Anthropic. The company also found references to committee approval processes and MEK leadership, but said it could not independently determine the precise level of central control. Cloning a person from 8,400 Telegram posts The most striking part of the operation involved a real activist whose Telegram identity was copied. According to Anthropic, the operators instructed Claude in Persian that it was now that person, then provided approximately 8,400 of the activist’s Telegram posts so the system could learn and reproduce his writing style. The AI-assisted account was subsequently used to conduct live political conversations with the activist’s existing contacts. Anthropic says that, to its knowledge, the people receiving those messages did not know they were interacting with an account being operated with AI assistance. This is materially different from a conventional chatbot or a static deepfake. The system was not simply producing a forged statement attributed to someone else. It was using a large archive of that person’s authentic language as behavioural training material, then applying the resulting imitation interactively. In practical terms, the deception moved from synthetic content to synthetic identity. Anthropic did not publish the identity of the impersonated activist, nor details of his contacts, and the public report does not establish what specific information the conversations produced. What it does establish is that the impersonation was operational rather than experimental: the cloned account was used in real exchanges with real people. From social-media monitoring to psychographic dossiers The impersonation sat inside a much broader targeting system. Anthropic says the network scraped more than 500 social-media channels and categorised individuals by location, age, profession, political orientation and arrest history. It then analysed approximately 51,944 archived messages from conversations to construct detailed psychographic dossiers on dozens of people inside Iran. The system was therefore not limited to broadcasting propaganda. It was also designed to understand specific audiences and individuals. Profiles could be used to decide what kind of message was most likely to resonate with a particular person, which political identity they appeared closest to and how they should be approached. Anthropic describes this as a structured targeting funnel rather than ad hoc social-media activity. That distinction is important in the Iranian context. Political activists, dissidents and opposition contacts inside Iran can face arrest and severe punishment. The report does not show that the dossiers directly led to arrests or other harm, but collecting and organising information such as arrest history and political affiliation adds a surveillance dimension to what would otherwise be described as an influence operation. A shared AI system for an influence network Anthropic found that the actors used a shared Claude-based platform named “Viktor”, with separate workspaces and persistent memory. Those memory files contained approved sources, prohibited words, account-management instructions and methods intended to reduce the risk of detection. One operator loaded MEK founding doctrine into the system as what the report called “strategic base data”, allowing others to reuse it across their work. This persistent-memory structure meant the AI did not have to be briefed from scratch for every task. Once doctrine, stylistic rules and operational constraints had been stored, the system could repeatedly produce material consistent with the network’s objectives. Anthropic says the same general playbook appeared across different workspaces despite the operators not sharing obvious account infrastructure. The network also used automated pipelines to coordinate Instagram posting schedules and tailor messages to different audiences. Some accounts initially avoided mentioning the Mojahedin at all, allowing material aligned with MEK/NCRI narratives to appear as neutral or independent political commentary. Content was distributed through the organisation’s own media ecosystem as well as accounts presented as ordinary news or activist profiles. Anthropic assessed the campaign as Category Two on its Breakout Scale: active on multiple platforms with distribution through NCRI-linked media properties and amplifier accounts, but without evidence of broad authentic penetration. Synthetic citizens and disguised organisational media The same infrastructure generated AI avatars presented as ordinary Iranians, complete with Persian audio, to promote Maryam Rajavi’s political programme. Anthropic says the synthetic nature of these personas was intentionally concealed. Operators also rewrote and redistributed content originating from MEK-affiliated media while stripping identifying features or presenting it through apparently independent accounts. The network’s political messaging targeted the Iranian government but also rival opposition currents, including monarchists and supporters of the Pahlavi camp. Anthropic documented fabricated video material attacking a member of the Pahlavi family and the use of the slogan “Neither Shah Nor Sheikh”, consistent with the NCRI’s broader competition with other opposition movements. That rivalry provides relevant context. Reuters describes the MEK as one of Iran’s principal organised opposition movements in exile and the dominant force behind the NCRI, led by Maryam Rajavi. Its relationship with other opposition currents is often contentious, while the extent of its support inside Iran remains uncertain. What can be attributed – and what cannot Anthropic’s attribution is unusually specific but still needs to be stated carefully. The company says its investigation linked the operation to MEK/NCRI and established that at least four participants worked for official NCRI media organisations. It also found a common operational playbook, committee review structures and repeated references to MEK leadership. On that basis, Anthropic said central tasking was likely. It nevertheless stopped short of saying it had proven that NCRI’s senior leadership directly ordered or managed every component of the operation. That caveat matters. The strongest public evidence supports describing GTG-84006 as a MEK/NCRI-aligned influence operation involving personnel from official NCRI media, rather than asserting that every action was directly commanded by the organisation’s top leadership. The broader significance of the case lies elsewhere. Earlier generations of synthetic media attempted to fabricate evidence: a photograph, a voice recording or a video. Here, AI was used to maintain an identity over time, remember doctrine, analyse targets and speak directly to real people while appearing to be someone they already trusted. The deepfake was no longer merely an artefact. It had become a participant in the conversation. Sources Anthropic — Countering misuse of AI: September 2026 https://www.anthropic.com/threat-intelligence-report-september-2026 AI Misuse Case Library — GTG-84006 activist impersonation case https://www.misuseofai.com/en/cases/gtg-84006-activist-impersonation/ Reuters — Who makes up Iran’s fragmented opposition? https://www.reuters.com/business/media-telecom/who-makes-up-irans-fragmented-opposition-2025-06-18/ Reuters — Iran’s divided opposition senses its moment https://www.reuters.com/world/middle-east/irans-divided-opposition-senses-its-moment-activists-remain-wary-protests-2025-06-19/ Reuters — NCRI and Maryam Rajavi https://www.reuters.com/world/middle-east/dissident-leader-abroad-urges-iranians-bring-down-khamenei-2025-06-24/ Keywords #DISINFORMED #Episode12 #Iran #MEK #PMOI #NCRI #IranianOpposition #Disinformation #InfluenceOperations #InformationWarfare #ArtificialIntelligence #AI #GenerativeAI #ClaudeAI #Anthropic #AIDeception #AIImpersonation #IdentityImpersonation #SyntheticIdentity #InteractiveDeepfake #DigitalImpersonation #PersonaCloning #BehaviouralCloning #Telegram #PsychographicProfiling #TargetProfiling #AudienceTargeting #SocialMediaManipulation #Astroturfing #SyntheticPersonas #NarrativeLaundering #CoordinatedInfluence #PoliticalInfluence #DigitalInfluence #OppositionPolitics #IranPolitics #OSINT #WRLD