France's Tchap, the encrypted messenger civil servants were supposed to use instead of WhatsApp or Telegram, was compromised on June 7.
France's National Cybersecurity Agency, ANSSI, detected the breach and brought in DINUM, the government's Digital Affairs Directorate. The accounts diverge from there. The attacker claims they accessed more than the government is willing to acknowledge; DINUM says the damage was limited. That dispute is itself informative. Governments rarely err toward overstating a breach.
Tchap was France's answer to a real problem: foreign messaging platforms sitting underneath sensitive civil service communication. Building your own solves the sovereignty concern. It does not solve the security problem. A custom-built system run by a government agency is not inherently more hardened than a commercial product with a dedicated security team. Switching away from Signal or WhatsApp out of geopolitical caution only helps if the replacement is actually safer.
France is not alone in learning this lesson. Governments across Europe have spent years building homegrown alternatives to US tech, with mixed results. Sovereign infrastructure is a legitimate policy goal. It just does not come with a security guarantee built in.