CNIL 2025 report: data leaks change in scale and nature
OP-ED · 18 JUNE 2026
By Gaëlle Tilloy, lawyer, and Jérôme Beaufils, President of SASETY · Lire en français
A joint perspective from Gaëlle Tilloy, attorney at the Paris Bar specialising in new technologies and personal data, and Jérôme Beaufils, President of SASETY
With more than 6,100 data breaches notified in 2025, the latest annual report of the CNIL (the French data protection authority) highlights a profound transformation of the threats facing organisations. Industrialised cyberattacks, a sharp rise in identity compromise, new risks linked to artificial intelligence and stronger regulator expectations: beyond the figures, the very nature of cyber risk is changing.
What lessons should companies draw from it? And how can they adapt their security strategy to this new reality?
The CNIL's 2025 report suggests a change of scale. Is that how you read it?
Gaëlle Tilloy
The report highlights an acceleration of data breaches.
But beyond the volume, it is above all the nature of the incidents that stands out. We are no longer facing a series of isolated events. We are seeing a growing number of large-scale breaches, sometimes affecting several million people, now hitting every sector of activity.
This massification profoundly changes the nature of the risk. A leak that used to affect a few thousand people can today simultaneously affect a significant share of the population.
The report shows that data leaks are changing in scale, and also in nature, becoming a major resilience issue for organisations.
Jérôme Beaufils
The findings presented by the CNIL closely echo the situations we encounter in the field.
What strikes us today is the level of exposure of many organisations, even more than the sophistication of attacks. We still regularly come across weak passwords, poorly protected access, dormant accounts or excessive privileges.
Privileged accounts in particular remain one of the most frequent weak points. When an attacker manages to compromise this type of account, the consequences can be considerable.
In many cases, a few known but never fixed weaknesses are enough to open the way to a compromise.
Why are data leaks taking on such proportions?
Gaëlle Tilloy
Several factors add up: the growing digitalisation of activities, the economic value of data and the industrialisation of the means used by cybercriminals.
Personal data is now a highly sought-after resource. It can be resold, used in fraud campaigns or serve as an entry point to other information systems.
Artificial intelligence will also allow attackers to be even faster and more effective, not to mention that AI systems themselves may become targets.
Jérôme Beaufils
Attackers are looking for efficiency above all.
Many incidents start with relatively simple scenarios: a reused password, a compromised account, poorly secured supplier access or a successful phishing campaign.
We are also seeing attackers become highly professional. They now have tools, services and sometimes even genuine subcontracting chains that allow them to industrialise their operations.
The simplest path often remains the most effective.
The report points to service providers and identities as new weak points. Why?
Gaëlle Tilloy
Organisations increasingly rely on service providers, cloud services and external partners.
The report reminds us that outsourcing does not transfer responsibility. Companies remain responsible for protecting the data they process, including when part of their activities is entrusted to third parties.
This reality mechanically broadens the exposure surface and calls for greater vigilance across the entire chain of trust.
Jérôme Beaufils
We regularly find that supplier accounts, third-party access or obsolete permissions are potential entry points for attackers.
At the same time, we are seeing a gradual shift of risk towards identities. Cybercriminals now try to exploit valid credentials more than to bypass technical protections.
A compromised credential can be used to launch attacks such as phishing, attempt a password reset, open access to banking and business applications, or reach sensitive data or critical systems. Identity has become one of attackers' main targets and is the starting point of more than 90% of attacks to date.
Why does the CNIL place so much emphasis on MFA, detection and awareness?
Gaëlle Tilloy
Because a significant share of breaches could be avoided with these measures.
80% of the large-scale breaches observed by the CNIL in 2024 were made possible by the takeover of an account protected only by a password. Many incidents are still linked to insufficient security measures, and the CNIL intends to step up its action on security.
Jérôme Beaufils
MFA has become essential, but on its own it is no longer enough.
The real question now is to understand who is connecting, to what, under what conditions and with what level of risk.
Organisations must be able to quickly detect unusual behaviour, authentication anomalies, suspicious privilege escalation or abnormal access attempts.
The shorter the detection time, the more the consequences can be limited.
Security today relies on combining preventive mechanisms, detection capabilities and systems that make it possible to react quickly when a risk is identified.
Is the human factor still the weakest link?
Gaëlle Tilloy
I prefer to say that users face increasingly sophisticated attacks.
A significant share of breaches still originates from human error, but above all this means that organisations must build this reality into their protection strategy.
As the report puts it, the aim is to “consider people as security players” and to “organise regular awareness sessions adapted to user profiles (employees, developers, executives, subcontractors, etc.)”.
Jérôme Beaufils
Above all, we see that attacks now exploit employees' everyday work.
Phishing campaigns perfectly reproduce the communications of a supplier, a client or a public authority. Some even use artificial intelligence to further personalise their messages.
The challenge is therefore to raise user awareness and also to quickly detect when an account or a behaviour becomes suspicious.
The ability to identify these weak signals and react quickly, ideally in an automated way, is becoming an essential part of protecting organisations.
Is artificial intelligence a game changer?
Gaëlle Tilloy
Artificial intelligence is one of the major topics of the report.
The issues are technological, legal and organisational at the same time. Companies need to address questions of governance, confidentiality, control of usage and protection of the data they share with these new tools.
The CNIL takes a pragmatic approach. It seeks to support organisations towards controlled use that complies with their obligations, rather than to slow down innovation.
Jérôme Beaufils
The challenge is to control the use of AI rather than to ban it.
In almost every organisation, employees already use generative AI services every day, sometimes without security or compliance teams being fully aware of it.
Companies must therefore be able to identify which services are used, which data is shared and which risks may be associated with these uses.
We are also seeing a major shift: more and more organisations are developing their own applications built on artificial intelligence models.
The question then goes beyond securing employees' use: the AI applications themselves, the data they handle and the interactions with the models used must also be protected.
Is the CNIL report part of a broader movement towards stronger requirements?
Gaëlle Tilloy
Between NIS2, DORA, the AI Act, growing client requirements, cyber insurers' expectations and sector-specific obligations, organisations face a convergence of regulations and requirements.
Ultimately, they all pursue the same goal: strengthening the resilience of organisations against threats that have become structural.
The CNIL adds a complementary dimension by reminding us that personal data protection is now one of the pillars of this resilience.
Jérôme Beaufils
The same questions now come up in audits, tenders, insurer questionnaires and compliance processes.
Organisations must demonstrate that they protect their identities, monitor their access, detect abnormal behaviour and can react quickly in the event of an incident.
Demonstrating protection is becoming almost as important as the protection itself.
This shift reflects a growing expectation of visibility, management and measurement of cyber risk.
Why does a data leak not mark the end of the cyber risk?
Jérôme Beaufils
Data or credentials compromised in a first incident are reused weeks or months later to carry out other attacks.
That is why organisations need continuous visibility over their identities, their access and their potential exposure.
The ability to track how risk evolves over time is becoming as important as the ability to react to the initial incident.
A data leak is often only the starting point of a chain of events that must be identified and controlled over time.
How can organisations concretely meet the expectations expressed by the CNIL?
Jérôme Beaufils
The report highlights several priorities: strengthening identity protection, detecting abnormal behaviour faster, controlling the use of artificial intelligence, better securing access and being able to demonstrate the effectiveness of the measures in place.
The difficulty is that these issues are often handled separately even though they are closely linked.
A phishing attempt, a suspicious authentication, exposed privileges, unusual network behaviour or inappropriate use of an AI service may seem like separate events. Yet when they concern the same user, they sometimes reveal a much greater risk.
Organisations therefore need a consolidated view of their risk exposure in order to quickly identify the most sensitive users, access rights or assets.
This visibility must come with the ability to continuously measure the effectiveness of the security systems deployed. Regulators, clients and insurers now look at the ability of these means to deliver the expected results, as well as at the means themselves.
Finally, detection must lead to concrete and, ideally, automated actions. Stronger authentication, temporary access restrictions, password resets, additional checks or investigation: risk reduction increasingly relies on the ability of the various security components to share their information and act in a coordinated way.
The challenge is therefore to build a coherent approach to understand, measure, react to and reduce risk over time, rather than piling up products.
Ultimately, what message should organisations take away from this report?
Gaëlle Tilloy
Beyond the findings, this report reflects a profound change in the regulator's expectations.
The CNIL no longer simply asks organisations to put security measures in place. It now expects them to be able to demonstrate their relevance, consistency and effectiveness over time.
Cybersecurity is thus becoming a governance topic in its own right, just like compliance, risk management or business continuity.
Companies must also realise that personal data protection and cybersecurity are no longer two separate topics. They now serve the same goal: preserving the trust of clients, employees and partners over the long term.
Faced with threats that are becoming more professional and changing in scale, organisations must adopt a continuous approach to assessing, improving and controlling their digital risks.
Jérôme Beaufils
Ultimately, the report reminds us that organisations today know the main risks they are exposed to.
The challenge now is to turn this knowledge into the ability to act.
Identity protection, access control, detection of abnormal behaviour, securing digital usage and regular validation of the security level can no longer be handled separately.
Companies need a unified view of risk that allows them to prioritise their actions and demonstrate the effectiveness of their systems over time.
More than ever, the challenge is to build a coherent approach that reduces cyber risk effectively and sustainably, rather than piling up tools.
In the press
Actualités & Médias
