France confirms taxpayer data stolen as hacker boasts of 2M records
The intrusion led to the theft of data belonging to 678,000 individuals and professionals.
Mystery man in silhouette red with binary code background. Kmatta/Getty.
- France’s tax authority confirmed stolen taxpayer data after a hacker claimed access to about 2 million records.
- DGFiP says the breach affected 678,000 individuals and professionals, including tax, business, address, and property data.
- The authority says user accounts, IDs, and passwords were not compromised, and affected people will be contacted directly.
- The incident follows a separate February breach involving 1.2 million bank accounts, raising concerns over government data security.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
France's tax authority, Direction Générale des Finances Publiques (DGFiP), has confirmed that taxpayer records were stolen in a cyberattack after a hacker claimed to have obtained around 2 million records.
On Friday, DGFiP said that a hacker claimed to have broken into its systems in June and July using stolen login credentials belonging to a DGFiP employee and an authorized third party.
An alleged attacker under the alias "ZeroBytes” posted a listing for the purportedly stolen database on Wednesday, claiming it contained information on more than 2 million French taxpayers.
According to the malicious actor, they gained access using stolen credentials and an MFA bypass.
They also claimed they still had access to DGFiP's systems and offered to sell it as well. However, DGFiP said that all unauthorized access to accounts used in the identified incidents was suspended upon detection.
“Upon detecting these intrusions, the French Public Finances Directorate (DGFiP) immediately suspended access to all accounts used in the identified incidents. However, the access controls carried out at that time did not reveal that these intrusions had led to data theft, due to the sophistication of the attack,” the authority said in its statement.
According to DGFiP, the intrusion led to the theft of data belonging to 678,000 individuals and professionals. The monitoring platform FrenchBreaches broke that figure down to approximately 393,000 individuals and 286,000 professionals.
The accessed details included tax data such as reference tax income, family quotient and withholding tax rate, as well as company names and SIREN numbers for businesses.
Cadastral data relating to addresses and property sizes were also accessed.
However, DGFiP said that user accounts, IDs, and passwords were not compromised.
Further investigations are ongoing to determine the exact nature and volume of the stolen data.
“Following the new information revealed by the ongoing investigations, additional security measures were immediately implemented, including preventative shutdowns of access to sensitive information systems,” DGFiP added.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
All affected individuals and professionals will be contacted directly by the authority at the start of the next week, specifying what data may have been affected and laying out the precautionary measures to take.
The incident comes just months after another breach involving France’s tax authority. Hackers used compromised government credentials to access data linked to around 1.2 million bank accounts in the FICOBA database in February. According to DGFiP, there is no known connection between the two attacks.
