On 1 September 2026, ANSSI launched REACTIV ("REponse et ACTion Interministérielle face aux Violations de données", an interministerial response and action plan for data breaches), an operational mechanism triggered at the request of the Prime Minister. The public announcement came on 7 September. What this mechanism reveals goes beyond the scope of the public administration.
The threat that made REACTIV necessary
For about a year, government departments have faced a new category of attacks. Loosely coordinated groups of young French people, in the words of ANSSI's director general, exploit databases of user accounts compromised in earlier data leaks. The technique is direct: test these credentials on ministry portals, log in without triggering an alert, exfiltrate data, then disappear. The term "hit and run" sums up the tactic.
These attacks do not seek to move deeper into networks or to remain there over time. They seek to access, once, data viewable with valid credentials. This is precisely what makes them hard to detect with traditional network monitoring tools.
The figures from ANSSI's Panorama of the 2025 cyber threat, published in March 2026, give the measure of the problem: the agency handled 196 incidents involving data exfiltration in 2025, a rise of 51% compared with 2024. Ministries and local authorities accounted for 24% of all incidents handled by ANSSI that same year.
What REACTIV concretely allows
REACTIV constitutes a "temporary shift of effort". ANSSI mobilises additional resources to support the affected ministries. But above all, it acquires a new power: that of requiring these ministries to take, within constrained timeframes, the measures it deems necessary to protect citizens' data.
This is a notable change of posture. Before REACTIV, ANSSI acted as an adviser: it analysed, recommended, trained. REACTIV gives it a power of injunction over the administration. The director general himself describes this mechanism as a "stopgap", pending measures to be entered in the State's 2026-2027 digital security roadmap. These measures cover two areas: strengthening authentication and clearing obsolescence.
The two gaps REACTIV exposes
The first gap is authentication. The attacks exploited by REACTIV work because accounts protected by a simple password remain accessible on public portals. Multi-factor authentication (MFA) blocks this category of attack: a valid credential is no longer sufficient if a second factor is required. According to a 2023 Microsoft study, MFA prevents more than 99% of credential stuffing attacks. Yet ANSSI considers it necessary in 2026 to impose this deployment rather than merely recommend it.
The second gap is obsolescence. Legacy systems, those that cannot integrate modern authentication, remain accessible because their replacement has been postponed. An unmigrated portal remains an entry point. The "clearing of obsolescence" that ANSSI enters in its roadmap concretely means inventorying the systems that do not support MFA or current authentication protocols, and planning their replacement.
These two gaps are not specific to ministries. They exist in the majority of organisations of significant size.
What this means for NIS2 entities
REACTIV formally targets State departments. But its logic foreshadows the evolution of ANSSI's posture towards entities subject to NIS2.
The NIS2 Directive, transposed into French law, places ANSSI in the position of supervisory authority for essential and important entities. Concrete obligations include access management, incident notification within 24 hours, and the implementation of proportionate technical measures. In February 2026, ANSSI imposed a fine of EUR 120,000 on a DNS operator for failing its NIS2 obligations. It was the first French case. It will not be the last.
The same ANSSI that imposes immediate measures on ministries within constrained deadlines is the one that investigates NIS2 non-compliance files. The distinction between the two contexts lies in the legal basis, not in the agency's appetite for firm intervention.
A concrete example: inventorying external access
An IT department wondering how to respond to the REACTIV signal can start with a precise question: which portals or interfaces accessible from outside require only a username and a password? The list is often longer than expected. VPNs with simple authentication, HR portals, SaaS project management tools, web mail, ticketing platforms. Every entry on this list that does not support MFA is a surface exposed to the type of attack that REACTIV is correcting within the administration.
This inventory is also the starting point for NIS2 compliance on access control. The operational pitfalls in implementing NIS2 notification are described in the article on five pitfalls of 24-hour notification.
The sequence to start now
Three actions follow naturally. The first is inventorying external access without MFA. The second is prioritising by sensitivity of the accessible data: an HR portal containing employees' personal data takes precedence over an internal reporting dashboard. The third is planning the replacement of systems that do not support modern authentication.
These three actions do not require an exceptional budget to be initiated. They require a decision and an owner.
REACTIV is a "stopgap" over an authentication gap that the administration has not yet corrected. For NIS2 entities, the same gap exists in many systems. The difference: the administration benefits from emergency support. Entities subject to NIS2, for their part, fall within the authority of an agency that has just shown it can require immediate measures.