The Secure Messenger the French State Built for Itself

Approximately 73,500 accounts on Tchap, the French government’s messaging platform, were hijacked in an incident attributed to an actor operating as "misere". The figure represents roughly 9% of the user base. A 13.5 GB data claim associated with the incident is unverified.

Tchap exists because the French state decided its internal communications should not depend on a foreign commercial messenger. That reasoning is sound: it removes a dependency, keeps data under domestic jurisdiction, and allows the security model to be inspected by the operator.

The trade is that the state now owns the whole problem. A commercial platform serving hundreds of millions has a security team proportional to that scale and receives attack telemetry from every customer. A national platform serving hundreds of thousands has neither.

It is large enough to indicate a systemic weakness rather than individually targeted accounts, and small enough to suggest a bounded condition — a particular authentication path, account type or provisioning route — rather than total platform compromise.

For an internal government messenger the sensitivity is not primarily message content. It is the graph: who is in which channel, who joined when, and which working groups exist at all. Organisational structure is intelligence, and a hijacked account reveals it without any message needing to be read.

Graded medium. The account figure is consistently reported; the access route is not established and the data claim is unverified.