Data Breach at French Tax Authority Exposes Information of 678,000 Individuals
The French Ministry of the Economy and Finance has disclosed a significant data breach involving the General Directorate of Public Finances (DGFiP). An attacker accessed the agency's systems and stole data belonging to 678,000 individuals. This incident came to light when a hacker using the alias "ZeroBytes" claimed responsibility and listed a stolen database for sale on the PwnForums hacking forum on August 12, 2026.
According to the French Finance Ministry, investigations revealed that the compromised access points had been used to consult and extract sensitive data, including tax information such as reference tax income, family quotient, and withholding tax rates. For businesses, the stolen data included company names and SIREN numbers. Additionally, cadastral data related to addresses and property sizes were also accessed. Fortunately, the online accounts of individual and professional users remained secure, and user IDs and passwords were not compromised.
In response to the breach, the French tax administration promptly shut down access to sensitive information systems and is collaborating with the National Cybersecurity Agency of France (ANSSI) to fully assess the impact of the incident. The hacker, ZeroBytes, also claimed to have gained access to the Serveur Professionnel de Données Cadastrales (SPDC), an online platform that provides access to the central land registry and property ownership records for approximately 20 million French citizens. However, they stated that they managed to steal only 252,149 records containing data on over 2 million individuals due to the difficulty of extracting the information.
The French Finance Ministry announced that it will begin contacting all affected individuals via email or letter next week, providing details on the data that may have been accessed or stolen and advising on necessary precautions. This breach is part of a troubling trend of cyberattacks affecting various French government agencies in recent months. Earlier this year, the French data protection authority imposed a €5 million fine on the national employment agency France Travail after hackers compromised the personal information of 43 million people. In another incident, the Ministry of Finance reported a breach affecting over 1.2 million user accounts linked to the national bank account registry systems.
The recent surge in cyberattacks highlights the vulnerabilities within government systems and the ongoing challenges in protecting sensitive data from malicious actors.
