France's DGFiP breach: 350k+ people hit via stolen passwords
ANSSI's report on the French tax administration breach: attackers used stolen staff credentials against password-only portals, exfiltrating data on 350k+ individuals over seven undetected weeks.