France's Directorate General of Public Finances (DGFiP) has confirmed that an attacker gained "illegitimate access" to its information system in late June 2026 and both viewed and extracted data on individual and business taxpayers. The confirmation came in a statement from the Economy Ministry (Bercy) late on Thursday 13 August, published only after a threat actor publicly claimed the intrusion on Wednesday. Bercy has deliberately declined to put a number on the victims or describe the data categories. Third-party counts vary widely: the specialist tracker French Breaches puts the figure at 678,437 people (392,867 individuals and 285,570 professionals), The Record frames the actor's own claim at roughly 600,000 victims, Frandroid headlines "nearly 700,000 potentially concerned," and Anadolu Agency, citing a BFMTV report, says the incident "could involve millions of users." No official count exists yet.
What Happened
The ministry's account, reproduced near-verbatim by AFP and carried by Europe 1, Nouvel Obs, RTL and France 24, is narrow and specific. A malicious actor obtained access to the DGFiP information system in late June 2026 following an identity usurpation ("usurpation d'identité"). That access was cut off in late June during a routine control or audit, before anyone outside the agency knew about it. First-pass investigations confirmed that despite being severed, the access had already permitted "the consultation and extraction of data concerning individuals and professionals."
The sequence matters: DGFiP detected and closed the access in June, but the breach only became public knowledge when the attacker claimed credit on 12 to 13 August, roughly six weeks later. On the back of that claim, DGFiP imposed additional access restrictions to block further illegitimate entry. Deep-dive investigations are ongoing to establish precisely which data and how many users were touched, and Bercy has committed to individually notifying affected users with the specific data categories exposed and, where relevant, the vigilance measures to adopt.
France's data protection authority CNIL has been notified. Per ZDNET, ANSSI and the Haut fonctionnaire de défense et de sécurité (SHFDS) are mobilised on the response.
There is a second, less-substantiated thread. ZDNET, Europe 1 and Nouvel Obs all report the attacker claiming a further DGFiP-linked exfiltration covering close to two million property and land owners in France. That second claim is attacker-sourced and has not been confirmed by Bercy. Frandroid additionally reports the attacker asserting they still retain access to the compromised account, which, if true, would contradict the ministry's containment narrative. Treat both as unverified claims.
What Was Taken
Accounts of the data set converge on a sensitive but non-credential collection. RTL, which reviewed reporting on a sample the seller published, lists tax identification numbers, reference taxable income (revenu fiscal de référence), withholding tax rates, email addresses and postal addresses. Anadolu Agency's list, sourced through BFMTV, adds names, birth details, phone numbers, records of correspondence with tax officials and business registration numbers (SIREN/SIRET-type identifiers) for professional accounts. Frandroid, citing the attacker's sample and Le Parisien, describes names, dates of birth, addresses, land registry identifiers, cadastral parcels and details of properties held.
Two consistent points across sources: no usernames or passwords are reported to be in the data, and Bercy has confirmed none of the specific field lists. Every data-category claim above traces to the attacker's own sample or to press review of it, not to the victim organisation.
The wealth-profiling angle is what makes this set unusually dangerous. French Breaches, quoted via RTL, breaks the individual records down by income band: 26,805 people with a reference taxable income above 100,000 euros, 386 above 1 million euros, and 8 above 10 million euros. Combine that with home addresses and cadastral parcel data and you have a targeting list. French Breaches also stated on X that the file is now being offered for sale for several thousand euros, and ZDNET reports the data resurfacing on dark web markets.
Frandroid reports that the actor is believed to be the same one behind the recent Intermarché Drive leak. That attribution appears in a single OTHER-tier source and should be held loosely.
Why It Matters
A tax authority is the single richest identity-resolution database a state holds. It links a legal name to a verified address, a national tax number, a declared income and, in the DGFiP case, property holdings. That is not a credential dump you rotate your way out of. The exposed fields are permanent identifiers, and the income banding turns a generic leak into a pre-sorted target list for physical burglary, high-value social engineering and tax-refund fraud. Frandroid and Le Parisien both flag targeted burglary as the immediate downstream risk, which is a rare case of a data breach carrying a direct physical-security consequence.
There is also a structural argument here that defenders in other national administrations should read closely. ZDNET frames the incident against France having become the most breached country in Western Europe in 2026, and quotes Surfshark researcher Luís Costa attributing the France-versus-Germany gap to centralisation: German public IT is distributed across the Länder, while France's administrative databases are hyper-centralised, making each one a high-value single target. One compromised identity inside a centralised system reaches further than one inside a federated one.
The uncomfortable detail is that DGFiP had recently generalised multi-factor authentication for users. Per ZDNET, the incident exposes the gap between hardening the front door for citizens and securing the privileged accounts and internal tooling behind it. MFA on the user-facing portal does nothing when the adversary is operating as an authenticated insider.
The Attack Technique
The only mechanism Bercy has stated is identity usurpation preceding the access. That phrasing is doing a lot of work and could describe a stolen or impersonated staff identity, a compromised third-party or partner account, or credential theft leading to account takeover. ZDNET characterises the vector as usurpation of identity and of access privileges, a known and highly effective route.
Anadolu Agency, citing BFMTV, supplies the most technically specific account available: a compromised internal VPN through which the attacker reached a taxpayer search tool. That detail is single-source and OTHER-tier, so it is a reported claim rather than an established fact. If it holds, the shape of the intrusion is legitimate-credential abuse over remote access, followed by mass querying of a lookup application, which is a data-harvesting pattern rather than an exploitation or malware event. That also explains the detection path: the access was caught during a routine control, consistent with anomalous query volume or session behaviour surfacing in review rather than in real time.
No malware, no CVE, no ransomware component has been reported by any source. No named group has claimed the incident under a recognised brand.
What Organizations Should Do
- Instrument bulk-query behaviour on citizen and customer lookup tools. The apparent failure here was not access control but volume detection. Rate-limit search interfaces, alert on per-account query counts that exceed a role's normal working pattern, and treat mass sequential lookups as an incident trigger rather than a report line item.
- Extend MFA and step-up authentication to internal and privileged paths, not just the public portal. Customer-facing MFA is a visible win that leaves the internal blast radius untouched. Enforce phishing-resistant factors on VPN, admin tooling and any application exposing bulk personal data.
- Treat VPN accounts as a monitored high-risk asset class. Require device posture checks, geo and impossible-travel alerting, and short session lifetimes. Review every VPN account with access to data-lookup applications and remove standing access that has no current business justification.
- Compress the gap between containment and disclosure. DGFiP cut the access in June and the public learned in August, from the attacker. Build a decision path that assumes the adversary controls disclosure timing, and pre-stage regulator notification (CNIL or your equivalent) and user comms.
- Model the physical-risk consequence when income or property data is in scope. If a data set can be sorted by wealth and joined to a home address, notification needs to include concrete physical-security and anti-burglary guidance, not generic phishing warnings.
- Warn affected users about the specific fraud that follows tax data. Tax IDs, withholding rates and correspondence history enable extremely credible impersonation of the tax authority itself. Tell users the agency will never request payment or credentials by phone, SMS or email, and expect a wave of DGFiP-themed lures.
- Revalidate the containment claim. Where an attacker publicly claims retained access, as reported here by Frandroid, assume the negative until you have re-verified session state, rotated the implicated identities and hunted for persistence established during the original access window.
Sources: France investigates tax authority breach after hacker claims 600,00... | Un "acteur malveillant" a piraté le fisc fin juin, près de 680 000... | Piratage à la DGFiP : 680 000 comptes compromis et un modèle IT rem... | Cyberattaque impots.gouv.fr : quels risques après la fuite de donné... | Cyberattack targets France's public finance system | Cyberattaque : le site des impôts a été piraté fin juin, annonce Bercy | Cybercriminalité : la Direction des finances publiques a été victim... | Le système d'information du fisc victime d'un "accès illégitime" fi...