French tax authority breach affects 678,000 individuals
The French Ministry of the Economy and Finance has announced a major data breach after an attacker infiltrated its systems, stealing the data of 678,000 individuals. The stolen data includes tax information and cadastral records.
What Happened
France has been rocked by one of its most significant cybersecurity incidents in recent years. The French Ministry of the Economy and Finance has officially confirmed a cyberattack targeting the systems of the General Directorate of Public Finances (DGFiP), the country's tax administration. The attack resulted in the theft of personal data belonging to 678,000 individuals and professionals. The incident came to light following a development that resonated throughout the cybercrime world. On August 12, 2026, a hacker using the alias "ZeroBytes" announced on a popular hacking forum called PwnForums that they were selling a database allegedly stolen from the DGFiP. Prompted by this post, French authorities immediately launched a comprehensive investigation.
In a statement, the Ministry specified that in-depth investigations conducted since August 12 established that attackers had used specific access points to infiltrate the systems and exfiltrate data. These access points were actively used until they were identified and shut down by the authorities. The attack targeted not only individual taxpayers but also businesses across the country, creating a wide impact area. The incident continues to be investigated in collaboration with France's National Cybersecurity Agency (ANSSI) as efforts to understand the full extent of the breach are ongoing.
What Data Was Stolen
The nature of the data compromised by the attackers highlights the severity of the incident. This information is highly sensitive and can be directly used for crimes such as fraud and identity theft. According to the Ministry's announcement, the stolen data includes:
- Tax Information: For individuals, this includes critical financial details that directly reflect their financial status, such as reference tax income, family quotient, and withholding tax rate. This information can be used to profile victims' finances and launch targeted fraud attacks.
- Business Information: For professionals and companies, basic corporate data such as company name and SIREN number (a unique identification number for businesses in France) were compromised.
- Cadastral Data: Land registry and property information belonging to property owners, such as addresses and property sizes. This data carries the potential for use in fraud targeting property owners or even physical security threats.
The combination of this type of data creates a powerful weapon for cybercriminals. For instance, a fraudster with access to a person's tax income and home address could send highly convincing fake tax refund or debt notification emails (phishing). Victims may be more vulnerable to such personalized attacks. Using a Data Breach Search tool to check if your information has been compromised in this or another breach can be a proactive security step.
How Did the Attack Happen
French authorities have not yet released detailed technical information about the attack. However, both the ministry's statement and the attacker's forum posts offer some clues as to how the attack may have occurred. The ministry stated that data was exfiltrated by "using access points" and announced that these points have been closed. This wording suggests the breach could have stemmed from a vulnerability in the systems or, more simply, from access gained by compromising the credentials of an authorized account.
More details were provided by the attacker, "ZeroBytes." The hacker claimed to have gained access to the Serveur Professionnel de Données Cadastrales (SPDC), an online platform operated by the tax authority that provides access to France's central land registry and property ownership records. According to their claim, this portal offered access to the data of approximately 20 million French citizens. However, the attacker stated they were unable to download the entire database because the data scraping process was too slow and difficult. They claimed to have only extracted data on over 2 million people from 252,149 records. The attacker's statement on the forum was particularly noteworthy: "I'm still logged into the panel, so if you want, you can buy it along with the database." This comment suggests the attacker may have gained persistent access to a system administration panel. The ministry, however, specifically emphasized that user IDs and passwords were not compromised in this breach. This detail suggests the attack targeted a more centralized system rather than individual end-user accounts.
Who Is Affected
Those directly affected by the data breach are the 678,000 individuals and professionals whose records are held in the systems of the General Directorate of Public Finances (DGFiP). This group encompasses a broad audience in France, including anyone who files taxes, owns property, or operates a business. The victims could be individual citizens as well as small or large-scale enterprises. Although it was stated that usernames and passwords were not stolen, these individuals are at significant risk due to the sensitivity of the other compromised data.
What You Can Do
The French Ministry of Finance has taken a proactive step and announced it will contact all affected individuals via email or letter starting next week. These notifications will provide detailed information about what data may have been leaked and the necessary precautions to take.
If you believe you may have been affected by this breach or if you receive an official notification, it is recommended that you take the following steps:
- Be Wary of Phishing Attacks: Scammers may use your stolen tax and address information to send you personalized fake emails, text messages, or letters. Be extremely skeptical of any communication that appears to be about a tax refund, a penalty notice, or a request to update your information.
- Use Official Channels: If you receive a communication allegedly from the tax office or another government agency, do not click on any links or download any attachments. Instead, verify the communication's authenticity by visiting the agency's official website by typing the address yourself into your browser or by calling them on their official phone numbers.
- Monitor Your Financial Accounts: Regularly check your bank and credit card statements for any suspicious transactions and report them immediately.
What the Company Is Saying
The French Ministry of the Economy and Finance stated that it is handling the incident with seriousness and is committed to a transparent process. In its official statement, it emphasized that access to sensitive information systems was shut down immediately after the attack was detected. It also stated that the French data protection authority, CNIL, was promptly notified. The ministry added that the investigation, conducted jointly with the National Cybersecurity Agency (ANSSI), is ongoing and that they are working to assess the full impact of the breach. The statement also included a commitment to inform victims and guide them on the necessary precautions.
French Government Agencies in the Crosshairs
This incident is the latest in a chain of cyberattacks targeting French government institutions. Similar events in recent months indicate that the country's cybersecurity infrastructure is under significant pressure. In January, the national employment agency, France Travail, was fined €5 million by the data protection authority after the personal information of 43 million people was stolen. Just a month later, the Ministry of Finance disclosed another breach at the national bank account registry (FICOBA), where a database containing over 1.2 million user accounts was stolen. More recently, France Titres, the agency responsible for issuing documents like IDs and passports, also announced a data breach. This series of events once again highlights how critical it is to follow the latest Data Breach News and enhance cybersecurity measures.
Source
This content was generated with AI assistance through our Argus Flow application. We are continuously working to improve Argus Flow; if you encounter any issues such as translation errors, incorrect sources, or unverified information, you can report them using the button below. We appreciate your feedback.