The French tax authority, the General Directorate of Public Finances (DGFiP), has confirmed that its systems were compromised in June, leading to the extraction of taxpayer data. This admission follows claims made by an individual using the alias "ZeroBytes" on a cybercrime forum, who advertised a database purportedly containing information on 2 million French taxpayers.
ZeroBytes asserted that the breach was achieved through the use of stolen credentials and a technique to bypass multi-factor authentication. The individual also claimed to maintain ongoing access to DGFiP's systems and offered to sell this access alongside the stolen database.
In a statement released on Thursday, August 13, 2026, DGFiP acknowledged the unauthorized access, stating it occurred in late June 2026 due to identity theft. However, the authority explicitly disputed ZeroBytes' claim of continued access, stating that the initial access was severed at the end of June as part of an audit. DGFiP confirmed that this access did allow for the consultation and extraction of data pertaining to both individuals and professionals.
Following the discovery, DGFiP implemented new restrictions to prevent further unauthorized access. The agency is currently conducting in-depth investigations to determine the precise scope of the data compromise and the exact number of affected users. Once this information is ascertained, DGFiP plans to report the incident to the French data protection watchdog, CNIL, and notify the individuals impacted.
This incident is one of several cybersecurity breaches affecting the French public sector this year. In February, France's Ministry of Finance, which oversees DGFiP, reported that attackers used stolen credentials to access a database containing 1.2 million French citizens' bank details. A few weeks later, the Health Ministry confirmed an attack on its healthtech supplier, Cegedim Santé, resulting in the theft of approximately 15.8 million administrative files, with 165,000 of these containing doctors' notes that, in some cases, revealed medical histories.
In April, the Interior Ministry acknowledged a breach at France Titres, the agency responsible for identity documents such as passports and driver's licenses. The alleged perpetrator, reportedly a 15-year-old, claimed to have affected between 18 million and 19 million people. Most recently, in June, the department managing Tchap, France's encrypted government messaging platform, investigated a suspected breach where attackers allegedly accessed over 73,000 user accounts, 643,000 messages, nearly 60,000 media files, and hundreds of chat rooms.
