Plan
archived
French Tax Agency Breach: Stolen Creds Exfil Undetected 7 Weeks
- Engineer — Learn: No specific software to patch, but the breach illustrates how stolen credentials paired with absent DLP and UEBA controls can sustain long-running exfiltration undetected — worth reviewing identity access patterns and egress monitoring in your own environment.
- SOC/IR — Plan: The seven-week detection failure highlights a gap in behavioral/data-exfiltration detection for legitimate-credential abuse; review or build UEBA rules to alert on anomalous bulk data access by staff accounts, especially against sensitive datastores.
- Leader — Learn: A government breach affecting hundreds of thousands of records through basic credential theft, with no detection for nearly two months, is a useful post-mortem for risk and board discussions around credential hygiene, MFA coverage, and data-loss detection maturity.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.