France's Directorate-General for Public Finances (DGFiP) has confirmed a sophisticated cyberattack resulted in the theft of personal data belonging to 678,000 taxpayers. The breach, described by tax officials as more complex than previous incidents, exposed income details, tax rates, and family circumstances for individuals, and SIREN registration numbers, business addresses, and authorized representative addresses for businesses.
The incident was first claimed by a threat actor in late June, with confirmation from the French tax administration following an immediate criminal investigation. The cybercrime unit of the Paris Public Prosecutor's Office has initiated a probe, assigning it to OFAC, France's dedicated cybercrime fighting office.
While the DGFiP emphasized that the stolen data does not grant access to taxpayers' secure accounts on impots.gouv.fr, the compromised information could be leveraged for highly credible phishing attempts or identity theft. Public Accounts Minister David Amiel has instructed the DGFiP to begin notifying affected taxpayers and to propose measures for strengthening security procedures. Notifications were expected to commence early the following week, with a focus on alerting individuals to the risks of identity theft and fraudulent information requests.
Authorities have not disclosed technical specifics of the attack or the motivations behind it. Investigators are working to determine the entry point of the attackers, their identity, and whether the stolen data has been sold or used.
This breach marks the third recent cyberattack targeting French government bodies, following incidents involving ANTS, the national secure documents agency, and INSEE, France's statistics authority. This pattern has raised concerns regarding the overall security posture of government information systems.
Taxpayers who are contacted about this breach are advised to treat any subsequent requests for passwords or banking information as fraudulent, regardless of how official they may appear.
