Threat Actor 'Misere' Claims Breach of French Government Messaging Platform Tchap

Key points

• Threat actor 'Misere' claims to have breached Tchap, France's state-operated secure messaging platform.
• French officials confirm roughly 73,000 government accounts were affected.
• The actor claims to have exfiltrated both message content and user data.
• 'Misere' does not map to any publicly tracked cluster or known APT designation.
• Whether all 73,000 accounts had message histories exposed, or only credentials, has not been clarified.

French officials are confirming what 'Misere' claimed first: a breach of Tchap, the state-operated secure messaging platform built to keep civil servants off consumer apps. Roughly 73,000 government accounts were affected, and the actor claims to have taken message content alongside user data.

Our earlier story on 12 June found that Tchap's architecture wasn't what failed then: social engineering got an attacker inside, and unencrypted public rooms did the rest. Whether this incident shares that vector is unknown. No vendor advisory has confirmed a method of compromise, and no CVE has been assigned to a Tchap-specific vulnerability.

Who is 'Misere'?

'Misere' does not map to any tracked cluster in public threat intelligence. No major vendor, CrowdStrike or Mandiant among them, has publicly associated this persona with a known APT designation. That gap doesn't imply the actor is unsophisticated or state-unaffiliated. It means attribution hasn't reached the threshold that warrants a cluster name. Medium confidence this is a single actor. Low confidence on anything else.

What was actually taken?

Stealing messages from a government-only platform points toward targeted intelligence collection or a plan to weaponize the data later. Both read as espionage-adjacent. Neither can be confirmed from available reporting.

The 73,000 figure also needs unpacking. Whether every one of those accounts had sensitive message histories exposed, or whether the number reflects a broader credential set with shallower access, matters enormously for downstream risk. That distinction hasn't been clarified publicly.

Should you worry?

France is not a soft target. ANSSI, the national cybersecurity agency, maintains an active defensive posture and publishes detailed threat reports. If an incident investigation is open, and given the scale it almost certainly is, their findings would be the authoritative source on tactics, techniques and procedures. Until then, the intrusion chain is guesswork.

For organisations that mirror France's model of sovereign infrastructure platforms, the practical concern is this: a platform built specifically to reduce exposure can still be a high-value target precisely because of who uses it. Perimeter thinking doesn't survive that.