Why did hijacked account breach Tchap?

Hijacked credentials can defeat encryption

France’s Tchap incident illustrates how attackers can breach an encrypted service without “breaking” the encryption itself.

The government warnings describe a scenario where adversaries used a hijacked user account to gain access to public chat rooms on the messaging platform. That implies the attackers obtained something the system inherently trusts: a valid identity within Tchap. Once an attacker has a legitimate account, the attacker’s messages and activity are treated as authorized traffic, so encryption protects confidentiality against network interception but not against a participant who is acting under stolen access.

This is why hijacked-account intrusions can be especially consequential:

• Legitimate session behavior looks normal. If the attacker continues using the session or account in ways that resemble the real user, standard network security controls may not trigger.
• Public room exposure can still matter. Even if the targeted content is described as “public chat rooms,” access can allow observation of discussions and metadata, and it can facilitate influence campaigns.
• Identity-layer defenses become the frontline. Weaknesses such as insufficient multi-factor authentication, poor detection of risky logins, reused credentials, or inadequate recovery workflows can convert a messaging app into an entry point.

For a platform used by a large government workforce—Tchap has 300,000+ monthly users—the stakes are amplified: compromise can affect day-to-day government coordination and could expose operational details.

The immediate “why” in the provided reporting is therefore clear: attackers leveraged stolen account access to enter the application as an authorized user. The underlying “how”—the specific technique used to hijack the account—is not detailed in the excerpt, and remains part of the investigation.

Overall, the episode is a practical warning that encrypted collaboration still depends on robust authentication and continuous account/session security.