Work back from the CSN's 7% and the French profession is on the order of 7,100 offices [14]. More than 500 of them were hit [3]. Divide the reported total, more than 35 million euros [1], across 500-plus victims and the average loss per office is around 70,000 euros [13]. That figure explains the silence better than any disclosure policy does: it is a sum a practice absorbs, or hands to an insurer [11], without issuing a statement.
Banks did try. Extra procedural checks on notary transactions went in during 2024, and the diversions continued [10]. Upstream tampering explains why. The instruction that reached the bank came from the real office on the real network; only the payment details had been altered beforehand, quietly, by an intruder already holding the network [2]. ANSSI sources told Le Monde the attackers were persistent and had deep access [6].
ANSSI has spent two years on the clean-up, working out of public view to help offices evict the intruders and rebuild defences [5]. The campaign is four years old [1], so roughly half of it ran before the national agency was in a position to coordinate an eviction [15].
French officials also weighed whether the intruders had issued fake notarised acts, or were selling that on demand as a service, with marriage certificates and real estate transfers as the outputs useful to illegal citizenship schemes [7]. Investigators report no forged documents so far, and say that if any exist, several years could pass before they surface [8]. The remedy the profession chose points at the same distrust: two-factor authentication on many notary-specific operations, and a rule that certain banking and financial details cannot travel by email at all and require a physical presence instead [9].
The reporting does not name an actor. No group has been named, no malware family identified, and no indicators released [17]. The account rests on the CSN's counts and on ANSSI sources speaking to Le Monde [3][6], relayed in the September 7 bulletin [12]. One profession over four years is not enough to say business email compromise generally has moved off the mailbox, but it does show that here the phishing email was the entry point rather than the fraud itself, and that the fraud took place where transaction data is assembled [2]. Controls built on the assumption that the mailbox is the crime scene could not catch tampering that happened upstream of it.
