Public Database Exposes 28.4M French Citizens’ Personal Data
What Happened – A publicly accessible database hosted in September 2024 contained more than 90 million rows of information compiled from a variety of prior breaches. The dump revealed 28,445,106 unique French‑citizen records, including email addresses, names, physical and IP addresses, phone numbers, and partial credit‑card data (payment type and last‑four digits).
Why It Matters for Trust & Control Assurance
- The incident is a textbook example of a control‑gap that continuous assurance programs are built to detect and remediate: lack of an up‑to‑date data inventory and missing classification of high‑risk assets.
- Unrestricted public access demonstrates weak access‑control policies and insufficient monitoring of data‑store configurations, undermining the ability to produce defensible audit evidence.
- Mapping this exposure to a single control objective—Data Asset Management & Access Controls—provides evidence that satisfies multiple frameworks (e.g., NIST CSF 2.0, ISO 27001) simultaneously.
Who Is Affected – General public in France; any organization that processes or stores French personal data (e‑commerce, fintech, health‑tech, etc.).
Recommended Actions
- Conduct a comprehensive inventory of all data repositories and classify personal data according to sensitivity.
- Enforce least‑privilege access controls and block any unauthenticated, internet‑facing endpoints that store PII.
- Deploy continuous configuration monitoring and alerting for unauthorized exposure of data stores.
- Capture and retain evidence of these controls to support audit readiness and regulatory reporting.
Source: Have I Been Pwned – French Citizens breach
Technical Notes
- Attack vector: Misconfiguration – public‑facing database without authentication.
- Data types exposed: Email, name, physical address, IP address, phone number, partial credit‑card data (payment type, last 4 digits).
- Scope: 28,445,106 unique records, >90 million rows total.