196 web leaks in a year — often with no zero-day

Your customer extranet has been running for five years. Teams talk about a “big rewrite” next year. Meanwhile the vendor patched the server, the firewall is current, and nobody flagged a critical CVE this week. Yet data often leaves exactly like that — not through a zero-day, but through a still-valid account, an API that returns too many fields, or storage reachable from the open internet. On 20 October 2026, France’s CERT-FR publishes a field report on that pattern — with hard numbers.

196 incidents in 2025, attacker complexity often low

In CERTFR-2026-CTI-008, the CERT-FR states it handled 196 web application data-exfiltration incidents in 2025, versus 130 in 2024. No sector is spared. The executive summary is blunt: in most cases the intrusion does not rely on a technical vulnerability — credential reuse, social engineering, or simply missing access control on exposed data.

The report gives concrete cases. In May 2025, an e-health organisation lost personal and medical data after an attacker took over a user account and queried an API tied to the database. In February 2025, several food-industry companies were hit after employees installed a fake Word-to-PDF converter that dropped an infostealer on workstations. CERT-FR also describes leaks enabled by infostealers on users’ personal machines accessing public services, or by compromise of a supplier account on a medical-results application.

Ten levers on what you already run

This is not an exhaustive security manual: it targets web apps already processing personal or sensitive data, and measures CERT-FR teams actually deployed after incidents to limit repeat events. They are grouped into ten tracks: data-handling policy, minimal user access, reduced network exposure, authentication beyond passwords, traceability of actions (user and source address), hosting hardening, log monitoring, automatic alerts and reactions when behaviour is abnormal, application security verification, and — for government bodies — RGS/PSSIE accreditation. Annexes show implementation examples (IP filtering, geo-blocking, time windows, request-rate limits) on stacks seen in real responses.

What a leader can decide this week

• Map real access : who can read or export customer data through the app, an API or a forgotten back-office — not just “who has a login”.
• Remove unnecessary exposure : ports, storage buckets, test environments copied into production; the report explicitly flags cloud services open by default.
• Turn on multi-factor authentication for privileged accounts and admin interfaces — password-only logins fail too often in incident data.
• Log and alert : record bulk downloads or abnormal API traffic; without alerts, exfiltration looks like normal use.
• Plan the rewrite without deferring security : CERT-FR argues you can sharply cut risk on a legacy app while waiting for replacement — if these ten tracks are a project, not a backlog footnote.