In France, a data breach occurs once every hour. In recent months, several public bodies have been affected: La Poste, France Travail and the ANTS, the portal that issues identity documents. This confidential information, which is sometimes highly sensitive, is sold on forums. It's then often purchased by cybercriminals and used to fuel all kinds of scams, including fraudulent operations involving bogus bank managers or brokers. It is often impossible for the victims to discern what is actually fake, and they're then left to deal with the consequences alone. 

Twenty-eight-year-old Amaia is a fitness coach. While she was waiting for a parcel to be delivered from the UK, she received a text message asking her to pay customs fees so that it could be dispatched to her. The young woman clicked on the link and did as she was told: it was the start of a nightmare. "Two or three hours later, I received a call from an unknown number, supposedly from my bank advisor, who told me that a fraudulent transaction had taken place that very morning," says Amaia. 

Scams fuelled by data 

The frightened young woman believed she was speaking to her bank manager, but the person on the other end of the line was actually the scammer himself. This was when the net started closing in on Amaia. "He reassured me by saying, 'Don't worry, we'll sort it all out so there won't be any problems.' After that they made me carry out a whole series of operations. I thought I was rejecting the fraudulent transactions but in fact, they were getting me to approve them."  

The cybercriminal knew a great deal about Amaia and managed to gain her trust; he even persuaded her to reveal her credit card details. All in all, the fraudster managed to steal €8,000 from Amaia. The young woman filed a complaint, to no avail. 

A €200 million fund to tackle an urgent issue 

Like Amaia, there are thousands of victims of online scams. Attacks have been facilitated by the numerous data breaches affecting businesses and public bodies in recent months. The ANTS, the French portal that issues official identity documents, is one of them; they had 11.6 million items of administrative data stolen. Following this major breach, the government announced a €200 million emergency plan to get up to date on cybersecurity. But this budget will only allow it to play "catch-up", according to Anne Le Hénanff, minister for AI and digital affairs.

"We're currently experiencing a digital revolution driven by artificial intelligence, which itself consumes a great deal of our data and could accelerate these scams and everything that might result from them," warns ethical hacker Clément Domingo. "Until sufficient funding is allocated to the issue, it will be difficult to raise the level of data protection."

Increasingly sensitive information is being stolen and the authorities are sounding the alarm: the consequences of these leaks are spilling over from the digital realm into the physical world. "The first case involves a data leak from the French shooting federation. Fake police officers turned up at people's homes claiming weapons had been stolen," explains Jérôme Notin, president of the Cybermalveillance.gouv.fr platform. "The second case involves data leaks linked to websites managing crypto assets, leading to kidnappings, hostage-taking, acts of violence and torture of the victims or their families."

Platforms that aim to offer support for the general public do exist – 17 Cyber or Cybermalveillance.gouv.fr are two such examples – but these sites are primarily designed to raise awareness and facilitate the filing of complaints. In most cases, the cybercriminals are not identified and the victims are not compensated.

"Over the last few years, most of the attacks have been coming from young cybercriminals – French ones, at that. Some are still teenagers and have realised they can make money quickly and easily; for some of them, this amounts to as much as €5,000 to €10,000 a week," explains Domingo.

Some cyber security experts recommend changing your digital identity by adopting an alias, using a password manager, or having parcels delivered to a collection point to protect yourself from scams. But most importantly: never click on links received via text message or email, and never give out sensitive information over the phone.