admin The new mechanism, called REACTIV — short for Réponse & Action Interministérielle face aux Violations de données — was announced by the National Agency for the Security of Information Systems, or ANSSI, after Prime Minister Sébastien Lecornu ordered reinforced support for ministries facing data breaches and compromised accounts.
ANSSI said the system allows it to mobilise technical expertise and operational resources immediately alongside affected ministries. It is designed to contain attacks faster, limit data exfiltration and impose urgent protective measures where weaknesses threaten information entrusted to public bodies.
Under the arrangement, ANSSI will be able to require ministries, within tight deadlines, to take immediate steps needed to protect citizens’ data. The agency will also centralise technical crisis communications when attacks involving this category of threat affect state services.
The move follows heightened scrutiny of government cyber defences after a large-scale intrusion targeting the Direction générale des Finances publiques, France’s tax authority, was disclosed in August. The breach exposed personal and fiscal information belonging to hundreds of thousands of taxpayers and triggered an official investigation, emergency mitigation measures and demands for stronger safeguards across government systems.
Authorities said the tax incident involved the misuse of compromised credentials rather than a simple breach of a single public-facing website. The attack intensified concern over the vulnerability of interconnected administrative platforms where stolen account details can provide attackers with access to sensitive databases.
Budget Minister David Amiel and tax authority director-general Amélie Verdier publicly addressed the incident in August, while ANSSI was brought into the response. The government also ordered an audit of the security of the tax authority’s information systems, particularly services connected directly with taxpayers.
The audit forms part of a broader programme accelerated by the Prime Minister to raise the security level of ministerial networks. Earlier this year, the government introduced a roadmap containing 40 priority actions across 10 areas, with ministries required to meet deadlines and the Prime Minister’s office monitoring implementation every three months.
Measures under that programme include stronger control of user accounts, vulnerability testing, faster detection of intrusions and greater use of automated tools to identify weaknesses. The government has also instructed state security teams to conduct controlled self-attacks intended to expose vulnerabilities before hostile actors exploit them.
REACTIV builds on the existing role of CERT-FR, the national and governmental computer security incident response team operated within ANSSI. CERT-FR already coordinates technical handling of incidents affecting public administrations, critical operators and other essential entities, while monitoring threats and vulnerabilities affecting France.
The new structure is intended to give ANSSI greater authority during fast-moving breaches involving government data. Rather than relying only on advisory support, the agency can now direct urgent remedial action across ministries and coordinate the technical message issued during a crisis.
ANSSI said the reinforced capability does not replace existing ministerial security teams but concentrates expertise when an incident crosses administrative boundaries or demands escalation. The arrangement is meant to shorten decision times while preserving each ministry’s responsibility for securing its systems.
The decision also comes against a broader pattern of cyber activity affecting French public institutions. ANSSI has warned that ministries, diplomatic bodies, defence organisations, justice institutions and technology entities remain targets for both cybercriminal and state-linked operations.
In July, France formally attributed cyber espionage activity associated with the Turla intrusion set to a unit of Russia’s Federal Security Service. ANSSI said the campaigns had targeted French strategic entities as part of wider intelligence-gathering operations affecting European Union and NATO countries.
Government data theft has become a particular concern this year. Official figures published in April showed France was recording an average of about three data theft incidents a day across state-related systems since the beginning of 2026, prompting Lecornu to demand faster execution of cybersecurity measures.
