French tax agency hit by cyberattack, hundreds of thousands potentially exposed
Victims will be notified this week.
Image by Cybernews.
- France’s tax authority confirmed hackers accessed its systems in late June and early July 2026.
- The breach may have exposed personal information from 678,000 people, though the exact data taken remains under investigation.
- French officials said the attack’s sophistication prevented initial access controls from detecting that data theft had occurred.
- Investigators are working with ANSSI and other security officials, while affected victims are expected to be notified this week.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
The General Directorate of Public Finances (DGFiP), France’s tax authority, has confirmed that hackers breached its systems and potentially stole personal information of 678,000 people.
According to a press release, the attackers gained access to the tax authority’s systems in late June and early July.
The intrusion allowed the hackers to “consult and extract” information from 678,000 people.
The tax authority doesn’t say what information was potentially taken, only confirming that researchers are currently trying to determine what information was accessed and how many individuals and businesses were affected.
“As soon as these intrusions were detected, the DGFiP immediately interrupted access to all accounts used in the identified incidents. However, access controls carried out on this occasion failed to detect that these intrusions had led to data theft, due to the sophistication of the attack,” the Ministry of Public Action and Public Accounts says in a statement.
Following the incident, additional security measures were taken to prevent recurrence. The DGFiP, along with the service of the Senior Defense and Security Official (SHFDS) and the National Agency of Information Systems Security (ANSSI), is currently investigating the breach.
Victims of the breach will be informed later this week.
According to FrenchBreaches, a website that tracks and monitors data breaches in France, the attack was claimed by a hacker called ZeroBytes.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
ZeroBytes claims to have extracted 252,149 lines of information, corresponding to 2,041,778 people. Supposedly, all they needed was a login and multi-factor authentication (MFA) bypass to remain undetected on the GDFiP’s Professional Cadastral Data Server.
The attacker shared part of the stolen data with the website. This showed that they had stolen names, dates of birth, postal addresses, telephone numbers, email addresses, and all kinds of tax-related data, such as income and cadastral data.
The DGFiP hasn’t publicly attributed the breach to any specific threat actor.
This is the most recent data breach to hit the French government.
In April 2026, the National Agency for Secure Titles (ANTS) confirmed that its database, which contained around 19 million records containing passwords, national ID cards, and driver’s license data, had been exposed. A few days later, a 15-year-old was arrested for his involvement in the data leak.
Earlier this year, hackers hit the unemployment agency France Travail and the French Interior Ministry. On top of that, an attacker accessed sensitive data on 1.2 million accounts in France’s critical FICOBA database.
Last year, attackers targeted the country's flagship carrier, Air France, the prestigious French school Sorbonne Université, and the French Football Federation.
