France's Tax Authority Reports Data Breach Affecting 678,000 Individuals
France's tax authority has disclosed a significant data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems, exposing data on 678,000 individuals and professionals. The breach was revealed when an alleged hacker, known as "ZeroBytes," took credit for the intrusion on a cybercrime forum and listed a database for sale. ZeroBytes claimed that the compromised portal contained data on approximately 20 million French citizens, but they managed to extract only 252,149 records. The hacker mentioned that the extraction process was challenging and time-consuming, which limited the amount of data obtained.
The attacker reportedly gained access using stolen login credentials and a technique to bypass multi-factor authentication. Following the detection of the breach, the DGFiP promptly suspended access to all accounts involved in the incident. However, the initial access controls did not reveal that data theft had occurred due to the sophistication of the attack.
Investigations conducted since August 12, 2026, confirmed that the compromised access points had been used to consult and extract data concerning 678,000 individuals and professionals. This included sensitive tax information such as reference tax income, family quotient, and withholding tax rates, as well as business data like company names and SIREN numbers.
The DGFiP assured that the online tax portals used by individuals and businesses were not compromised, nor were their usernames or passwords. The agency has notified the CNIL, France's data protection authority, about the breach. In response, the DGFiP has implemented additional security measures, including preventive shutdowns of access to sensitive systems, and is collaborating with the finance ministry's security office and the national cybersecurity agency ANSSI.
This incident is part of a troubling trend, as multiple French government agencies have faced cybersecurity incidents in recent months.
