France’s tax authority admits hackers made off with data on 678,000 individuals
An attacker used stolen credentials and an MFA bypass to steal tax data on 678,000 individuals from France's tax authority DGFiP.
France's General Directorate of Public Finances (DGFiP) disclosed that intrusions into its portals exposed tax data, including reference tax income, family quotient, withholding tax rate, and business identifiers such as company name and SIREN number, on 678,000 individuals and professionals. An attacker using the alias 'ZeroBytes' claimed credit on a cybercrime forum and offered a stolen database for sale, claiming the portal contains data on roughly 20 million citizens. DGFiP suspended the affected accounts, notified the CNIL, and is working with ANSSI and the finance ministry's security office; it said the main online tax portals and their login credentials were not compromised.
- Attacker 'ZeroBytes' claimed credit on a forum and listed the stolen database for sale
- Exposed data includes reference tax income, family quotient, withholding rate and SIREN numbers
- DGFiP said individual and business tax portals and their passwords were not compromised
- Agency suspended affected accounts, notified CNIL, and is cooperating with ANSSI
- Latest in a run of cybersecurity incidents affecting French government agencies
Full article357 words · extracted from helpnetsecurity.com · click to collapse
France’s tax authority has disclosed a data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems, saying the intrusion exposed data on 678,000 individuals and professionals.
The incident came to light after an alleged attacker using the alias “ZeroBytes” took credit on a cybercrime forum and listed a stolen database for sale.
ZeroBytes said the compromised portal contained data on about 20 million French citizens, but they only managed to extract 252,149 records containing data on more than 2 million people.
“We couldn’t finish the extraction because honestly, it’s just horrible to scrape and would have taken months. I’m still logged into the panel, so if you want, you can buy it along with the database,” they wrote. “I’m not going to sell this one for very much anyway. And as always, no mention from France about this incident.”
They said they gained access using login credentials and an MFA bypass technique.
“Upon detecting these intrusions, the French Public Finances Directorate (DGFiP) immediately suspended access to all accounts used in the identified incidents. However, the access controls carried out at that time did not reveal that these intrusions had led to data theft, due to the sophistication of the attack,” DGFiP said.
“The in-depth investigations conducted since August 12, 2026, have established that, prior to their interruption, these access points had been used to consult and extract data concerning a total of 678,000 individuals and professionals, including tax data such as reference tax income, family quotient, and withholding tax rate, and, for businesses, data such as their company name and SIREN number,” it added.
DGFiP says the online tax portals used by individuals and businesses were not compromised, and neither were their usernames or passwords. The agency has also notified the CNIL, France’s data protection authority.
DGFiP has since put additional security measures in place, including preventive shutdowns of access to sensitive systems, and is working with the finance ministry’s security office (SHFDS) and the national cybersecurity agency ANSSI.
This breach is just the latest in a run of cybersecurity incidents that have impacted multiple French government agencies in recent months.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/08/17/france-tax-authority-data-breach/