Sophisticated Cyberattack Exposes Data of 678,000 French Taxpayers

France’s tax agency says hackers stole data on 678,000 taxpayers, including income and tax details, in a sophisticated cyberattack.

A threat actor claimed to have breached France’s tax agency in late June. France’s tax administration confirmed that a cyberattack exposed personal data of 678,000 individuals and businesses, prompting an immediate criminal investigation. The cybercrime unit of the Paris Public Prosecutor’s Office has opened a probe and handed it to OFAC, France’s dedicated cybercrime fighting office. Tax officials described the attack as more sophisticated than anything they’d faced before.

“The attack allowed hackers to extract data relating to 678,000 users of France’s tax system, including both private individuals and companies.” reports French media RFI. “Tax authorities said the incident was more complex than cyberattacks they had faced in the past, potentially renewing concerns over the security of government information systems following a series of recent breaches involving other public bodies.”

The Directorate-General for Public Finances (DGFiP) stressed that the stolen data doesn’t grant access to taxpayers’ secure accounts on impots.gouv.fr. That’s a meaningful distinction, but income figures, tax rates, and family circumstances are exactly what an attacker needs to make a phishing email or phone call sound credible enough to extract a password or bank account number.

“Officials said those affected would be contacted from early next week, with particular emphasis on alerting them to the potential risk of identity theft and fraudulent attempts to obtain further personal information.” continues RFI.

French authorities did not disclose technical details about the cyberattack or its motivation.

The breach follows recent attacks on systems linked to ANTS, the national secure documents agency, and INSEE, France’s statistics authority. Three government bodies hit in quick succession is a pattern, not a coincidence.

For businesses, the exposed data was considered less sensitive, SIREN registration numbers, business addresses, and the address of the authorized representative. Public Accounts Minister David Amiel has asked the DGFiP to start notifying affected taxpayers from Monday and requested proposals on how to strengthen security procedures.

Investigators still need to establish how the attackers got in, who they are, and whether the data has already been sold or used. Anyone contacted about this breach should treat follow-up requests for passwords or banking information as fraudulent regardless of how official they sound.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, France’s tax agency)

---

---