France's Tax Authority Confirms Late-June Data Breach After Hacker Advertises Stolen Records on Cybercrime Forum
France’s Tax Authority Confirms Late-June Data Breach After Hacker Advertises Stolen Records on Cybercrime Forum #
France’s General Directorate of Public Finances (DGFiP) confirmed Thursday that a cyberattack in late June resulted in the theft of personal data from both individual and professional taxpayers. The Finance Ministry made the announcement after a hacker disclosed the incident publicly before the agency did.
A threat actor using the alias ZeroBytes posted on a cybercrime forum Wednesday, claiming to hold a large database of stolen French taxpayer records. The hacker said access was obtained through stolen credentials and a multi-factor authentication bypass, and claimed to still have an active foothold inside DGFiP systems. The agency denied that claim.
In its Thursday statement, the DGFiP said the intrusion followed the identity theft of a person who held legitimate access to its information systems. The agency said it terminated all accounts linked to the identified incidents once the breach was discovered, but acknowledged that initial access controls did not detect the data being viewed and extracted.
FrenchBreaches, a platform that monitors data leaks in France, reported that ZeroBytes claims to have extracted approximately 678,000 lines of data, comprising around 393,000 individual taxpayer accounts and 285,000 professional accounts. According to The Record, the hacker separately advertised a larger dataset said to cover more than two million people. Neither dataset has been independently verified.
The data referenced in the hacker’s postings includes names, dates of birth, addresses, tax identification numbers, email addresses, family details, and tax status information for households and businesses. Banking credentials and passwords were not reported to be among the compromised data.
The DGFiP said it will contact all individuals and businesses whose data may have been affected, explaining what was exposed and advising on protective steps. It also said it will notify CNIL, France’s data protection authority, and file a criminal complaint with law enforcement.
The breach follows several other cyberattacks on French government agencies this year. Earlier incidents affected the national secure-documents agency, the Education Ministry’s student account system, and France’s National Bank Accounts File, a database covering more than 80 million individuals that was compromised in February.
The DGFiP said investigations are continuing to determine the precise number of affected individuals and businesses.
Copy link