The Directorate General of Public Finances (DGFiP), France's tax authority, has confirmed that its information systems were breached, leading to the extraction of data belonging to individuals and businesses. The French Economy Ministry stated that an attacker gained unauthorized access to DGFiP systems in late June by stealing or misusing an identity. This intrusion allowed the attacker to view and extract data.
The unauthorized access was detected and terminated in late June. The incident became publicly known after a hacker claimed responsibility earlier this week, prompting the tax authority to implement additional restrictions to prevent further unauthorized access.
Authorities are currently investigating to determine the precise scope of the accessed or stolen information and the number of affected individuals and businesses. The DGFiP has committed to individually contacting those whose data was compromised, informing them of the exposed information and recommended precautions. The agency also plans to notify France's data protection authority, file a criminal complaint, and provide further updates as the investigation progresses.
A hacker operating under the alias ZeroBytes claimed responsibility for the attack, according to FrenchBreaches, a website that monitors data leaks in France. ZeroBytes asserted that they obtained data on over 600,000 individuals. The claimed information includes names, other personal details, tax identification numbers, email addresses, family circumstances, and tax status information. These claims and the authenticity of the purportedly stolen data have not been independently verified by the DGFiP.
According to the hacker's claims, they gained access to internal servers, which enabled them to connect to the agency's VPN and utilize an internal tool to search for information on individuals and businesses. The attacker stated that data exfiltration began before their access was cut off. The DGFiP has not publicly attributed the breach to a specific threat actor or confirmed the hacker's specific claims regarding the method or extent of the data stolen.
This incident marks another cybersecurity event affecting a French government agency this year. In April, the National Agency for Secure Documents (ANTS), responsible for passports and identity cards, experienced a targeted website attack. The same month, the Education Ministry disclosed an attack on a student account management system, exposing student personal information. In February, a segment of the National Bank Accounts File, a database of bank accounts in France, was breached, exposing information related to approximately 1.2 million accounts out of over 300 million entries.
French authorities have been actively pursuing individuals suspected of targeting public institutions. Earlier this year, a 20-year-old man was arrested on suspicion of carrying out numerous data breaches against government bodies, sports federations, and private companies.
