60
France investigates tax authority breach after hacker claims 600,000 victims
France's tax authority DGFiP confirmed hackers extracted data on individuals and businesses; a hacker claims more than 600,000 victims.
France's Economy Ministry said an attacker gained unauthorized access to DGFiP systems in late June by stealing or misusing someone's identity, viewed and extracted data, and was cut off after detection. A hacker using the alias ZeroBytes claimed via FrenchBreaches to have taken data on over 600,000 people, including names, tax identification numbers, emails, family circumstances and tax status; the claim is unverified. The DGFiP will notify affected individuals, report to France's data protection authority and file a criminal complaint. It follows other 2026 breaches at ANTS, the Education Ministry and the National Bank Accounts File.
75
60
60
France’s tax authority admits hackers made off with data on 678,000 individuals
An attacker used stolen credentials and an MFA bypass to steal tax data on 678,000 individuals from France's tax authority DGFiP.
France's General Directorate of Public Finances (DGFiP) disclosed that intrusions into its portals exposed tax data, including reference tax income, family quotient, withholding tax rate, and business identifiers such as company name and SIREN number, on 678,000 individuals and professionals. An attacker using the alias 'ZeroBytes' claimed credit on a cybercrime forum and offered a stolen database for sale, claiming the portal contains data on roughly 20 million citizens. DGFiP suspended the affected accounts, notified the CNIL, and is working with ANSSI and the finance ministry's security office; it said the main online tax portals and their login credentials were not compromised.
70
60
Sophisticated Cyberattack Exposes Data of 678,000 French Taxpayers
Hackers stole personal and tax data of 678,000 individuals and businesses from France's tax agency DGFiP, prompting a Paris criminal investigation.
France's Directorate-General for Public Finances (DGFiP) confirmed a sophisticated cyberattack exposed data on 678,000 users of the tax system, including income figures, tax rates and family circumstances for individuals and SIREN registration data for businesses. The Paris prosecutor's cybercrime unit opened a probe and referred it to the French anti-fraud office OFAC after a threat actor claimed the breach in late June. Officials stressed the stolen data does not grant access to secure accounts on impots.gouv.fr, and taxpayer notification begins Monday with warnings about identity theft and fraudulent follow-up requests. The incident follows recent breaches at the ANTS documents agency and the INSEE statistics authority.
80
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
Mistral raises €3B as sovereign AI becomes big business
Mistral AI raised a €3B Series D at a €21B+ valuation, led by Samsung Electronics, to scale European compute capacity and sovereign AI services.
French AI lab Mistral AI raised €3 billion (~$3.58B) at a post-money valuation above €21 billion, which it calls the largest equity round ever completed by a European technology company. Samsung Electronics led the round, with EQT's Scaleup Europe Fund and PSG Equity as co-leads; a16z, Nvidia, Salesforce Ventures, Advent, BlackRock, and Luxembourg also participated. The company plans to build 1 GW of European compute capacity by 2030, offer region-selectable query processing, and host third-party open-weight models as part of a sovereign AI strategy. Mistral operates in 20 countries and targets governments and enterprises seeking control over AI models and data residency.
68
Risky Bulletin: BEC campaign steals €35 million from French notaries
Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.
A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.
72
G7 Urges Fast-Track on Quantum-Safe Cybersecurity Rules
G7 cybersecurity agencies led by France's ANSSI urged accelerated transition to post-quantum cryptography, prioritizing critical systems and phased, risk-based migration.
Under France's 2026 G7 Presidency, ANSSI, chairing the G7 Cybersecurity Working Group, published a September 3 call to action urging governments and organizations to begin quantum-safe (PQC) transitions now, reframing the quantum threat as near-term. The document, signed by the national cyber agencies of all G7 members and supported by the EU Commission and ENISA, outlines five priorities including national PQC strategies, R&D, public-private partnerships, and integrating PQC into cybersecurity requirements. It recommends cryptographic inventories, dependency mapping, prioritizing the most critical systems, and buying PQC-integrated products during normal renewal cycles. ANSSI will stop vetting non-quantum-safe products in 2027, with PQC mandatory in some security product procurement by 2030.
60
60
Week in review: Microsoft fixes exploited Office zero-day, Fortinet patches FortiCloud SSO flaw
60
60
60
60
60
60
60
60