French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks
Attackers with infostealer-stolen DGFIP staff passwords scraped French tax data on 350,000 individuals and 250,000 businesses, undetected for seven weeks.
ANSSI reports attackers used dozens of DGFIP staff passwords, likely stolen by infostealers from unmanaged personal devices, to access the PIGP and ADER portals and scrape the E-Contact messaging tool. Data on roughly 350,000 individuals and 250,000 businesses was taken in June and July, plus land-registry data on nearly 435,000 households via the APEX partner portal. SOC password resets failed to terminate the attacker's active ADER session, and ADER was not monitored at all, letting 11 GB flow unnoticed over ~16 hours. The theft surfaced only on August 12 when the attacker claimed it on an online forum.
- Stolen staff passwords, likely from infostealers on unmanaged devices, enabled access
- SOC password resets did not kill the attacker's active ADER session
- Second route via APEX portal exposed land-registry data on ~435,000 households
- ANSSI sensors only watch RIE and internet edges, missing application-level activity
- Attacker reached the RIE through compromised Education ministry systems
- ATT&CK
- T1078 Valid AccountsT1555 Credentials from Password StoresT1213 Data from Information Repositories
- Organizations
- DGFIPANSSIFrench Ministry of Education
From the original article
6 min read at thehackernews.com
An attacker used stolen passwords of staff at France's tax administration to take tax data on hundreds of thousands of taxpayers and businesses in June and July. Neither the tax administration nor France's national cybersecurity agency saw the data leave. The attack was not sophisticated, the agency, ANSSI, says in a report (in French) published on Tuesday: it worked because of weak
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.