Once the phish lands and the network is taken over, the attacker owns the record of a transaction before it becomes an instruction to a bank [2]. That ordering is the trick. The wire leaves with a legitimate sender and a legitimate file reference, carrying an account number that was edited in place, so the receiving bank has no anomaly to score. Which is why the extra procedural checks banks applied to notary transactions in 2024 did not end the campaign [8]. A check on the shape of a transaction does not catch a change to its content when the content is authored by the compromised party.
The arithmetic explains the four years. More than EUR 35 million across more than 500 offices [1][3] averages roughly EUR 70,000 per office [1]. Spread across four years, that is about EUR 8.75 million a year for the whole profession [2], and the 7% figure implies a population near 7,100 offices [3]. Per office, the loss is one payment, not a drained account. Nobody outside had a reason to correlate them: none of the intrusions had been disclosed before Le Monde's reporting [4].
The two procedural changes read as a diagnosis. Two-factor authentication on notary-specific operations addresses the entry [9]. Banning certain banking and financial details from email and requiring physical presence instead [9] concedes something larger, which is that no digital channel reaching the office was trusted to carry a payment detail intact. Requiring a human to turn up in order to hand over account details is a nineteenth-century control, and the reporting does not claim it has stopped the losses, only that it is now the rule [9].
Neither change reconciles anything. The report describes no check that re-reads an executed transfer against the account details on the signed instrument before the money settles [13]. That is the control this campaign argues for, because it is the only one that operates after the attacker has had their edit. Everything else operates before.
The evidence has real gaps. There is no dwell time per office, and no named group [14]. ANSSI's two years of remediation sit inside a four-year campaign [1][5], so approximately the back half ran while the agency was already evicting intruders and the banks' new checks were live [4][8], which is also the reason to treat 500 as a count of what was found rather than a total. On forgery, officials feared fake notarised acts, including marriage certificates and manipulated real estate deals usable in citizenship schemes [7]. Investigators have found none, while also saying such documents could take years to surface [10]. The clean result is bounded by that timeline, not by the thoroughness of the search.
For anyone running payments through a workflow where the same trusted party both authors and stores the instruction, the transferable part is narrow. Either the verification sits after the point where the record can be altered, or the detail leaves the reachable channel entirely. The notaries chose the second.
