France’s Tchap messenger breached; officials and hacker clash on severity

France developed its own encrypted messaging platform to give government employees a secure alternative to WhatsApp and Telegram. That system, called Tchap, has now been compromised, though the French government and the hacker behind the breach sharply disagree on the extent of the data stolen.

The French National Cybersecurity Agency (ANSSI) detected the intrusion on June 7. The Digital Affairs Directorate (DINUM) , which oversees the platform, has acknowledged the incident but has not confirmed the full scope of the compromise. According to officials, the breach was limited and did not expose sensitive government communications.

The attacker, however, claims otherwise. In posts on hacking forums, the individual asserts that a much larger cache of messages and user data was exfiltrated, including internal discussions among civil servants. This contradiction has fueled uncertainty about the true scale of the damage and raised questions about the security of France’s push for digital sovereignty.

Tchap was launched in 2019 as a homegrown, end-to-end encrypted alternative to commercial messaging apps. It runs on the Matrix protocol and is intended for official use by French public sector employees. The breach represents a significant embarrassment for a project meant to reduce reliance on foreign-owned platforms.

As of now, ANSSI and DINUM have not released a detailed forensic report, and the hacker has not provided verifiable proof of the claimed data haul. The incident underscores the ongoing tension between national security priorities and the practical challenges of building secure, sovereign digital infrastructure.