France's Tchap Breach: Access Control Failure, Not Encryption Flaw

France's sovereign Tchap messaging platform was compromised in June 2026 when an attacker gained a user account and retrieved roughly 643,000 government messages. The vulnerability lay not in encryption but in weak access controls: once logged in, the system allowed unlimited bulk retrieval with no safeguards. The lesson is clear: encrypted systems also need strong session management and monitoring to stay secure.