BEC campaign steals €35M from French notaries over four years

Over the past four years, hackers orchestrated one of France's most persistent financial crimes, stealing more than €35 million from the country's notary offices through a campaign of phishing emails and network infiltration. The attackers' method was methodical and quiet: they breached companies through deceptive emails, established themselves deep within corporate networks, and then methodically altered the details of financial transactions to redirect wire payments into their own accounts. According to reporting by Le Monde and confirmed by France's notary supervisory body, the Conseil Supérieur du Notariat, the campaign compromised more than 500 notary offices—roughly 7 percent of all notaries operating in France.

What made this campaign particularly alarming to French authorities was not just the scale of the theft, but the potential for something far worse. Government officials worried that the attackers might have used their access to forge notarized documents—marriage certificates, real estate deeds, property transfers—the kind of official paperwork that could facilitate identity fraud or illegal citizenship schemes. The fear was not merely that money was being stolen, but that the entire legal foundation of transactions could be undermined. Investigators have found no evidence that forged documents were actually created, though officials acknowledge that if such forgeries exist, they could take years to surface in the system.

France's cybersecurity agency, ANSSI, spent two years working largely out of public view to help notaries expel the attackers and rebuild their defenses. Sources within ANSSI described the intruders as unusually persistent and deeply entrenched in their victims' systems—the kind of adversary that does not leave easily once it has established a foothold. The attackers were patient, moving slowly through networks and making incremental changes to transaction records, which made detection difficult. Some notaries discovered the breaches only after ANSSI's intervention; others never knew they had been compromised until the agency came knocking.

The financial toll was distributed unevenly across the sector. Some notary offices absorbed the losses directly; others had cyber insurance policies that covered portions of the theft. But after four years of quiet infiltration and systematic theft, the entire profession began to take the threat seriously in ways it had not before. The notary sector implemented new procedural safeguards: many operations now require two-factor authentication, and sensitive banking and financial information can no longer be transmitted by email—clients must appear in person to authorize such transfers. Banks themselves added extra verification steps when processing notary transactions starting in 2024, yet even these measures did not immediately stop the attacks. The campaign continued for months after the banking sector tightened its procedures.

What remains uncertain is whether the full scope of the damage has been discovered. Investigators have not confirmed any forged documents, but the absence of evidence is not evidence of absence. If the attackers did create false notarized acts and those documents entered the legal system, it could take years before they are identified and the consequences become clear. The French notary sector is now more vigilant, more skeptical of routine requests, and more willing to invest in security infrastructure. But the campaign serves as a reminder that even highly regulated professions with formal procedures and institutional oversight can be systematically compromised by patient, well-resourced attackers who understand how to move through networks without triggering alarms.