France's General Directorate of Public Finances (DGFiP) has confirmed a data breach affecting 678,000 individuals and professionals after an attacker gained unauthorized access to its systems. The incident, which came to light following claims made by an alleged attacker on a cybercrime forum, exposed sensitive tax data.
According to the DGFiP, in-depth investigations initiated on August 12, 2026, established that prior to their interruption, unauthorized access points were used to consult and extract data. This information included reference tax income, family quotient, and withholding tax rates for individuals, and company names and SIREN numbers for businesses.
The agency stated that upon detecting the intrusions, it immediately suspended access to all accounts involved. Initially, access controls did not reveal data theft due to the attack's sophistication. The DGFiP clarified that the online tax portals used by individuals and businesses were not compromised, nor were their usernames or passwords.
An individual using the alias "ZeroBytes" claimed responsibility for the attack on a cybercrime forum, offering a stolen database for sale. ZeroBytes asserted that the compromised portal contained data on approximately 20 million French citizens but stated they only managed to extract 252,149 records, which they claimed contained data on over 2 million people. The attacker attributed the incomplete extraction to the difficulty of scraping the data. ZeroBytes also claimed to have gained access using login credentials and an MFA bypass technique.
The DGFiP has notified the CNIL, France's data protection authority, about the breach. In response to the incident, the agency has implemented additional security measures, including preventive shutdowns of access to sensitive systems. It is also collaborating with the finance ministry's security office (SHFDS) and the national cybersecurity agency ANSSI to address the breach. This incident is part of a series of cybersecurity events impacting various French government agencies in recent months.
