The hacking crew operating under the alias ZeroBytes has claimed it breached and exfiltrated the database of France's Ministry of Housing, according to AFP reporting relayed by a single Telegraph-hosted post (S1). That post says the attackers claim access to nearly 149 million records covering property owners and account data. Readers should treat that claim carefully: as of this writing, the Housing Ministry element rests on one lower-tier source, and no ministry statement, CNIL filing, or ANSSI advisory corroborating it appears in the available material. What is firmly established is the actor. The same ZeroBytes alias is the confirmed claimant behind the June 2026 intrusion at France's tax authority, the Direction Générale des Finances Publiques (DGFiP), a breach the Finance Ministry publicly confirmed on 14 August 2026 and which the agency itself sized at 678,000 individuals and businesses.
What Happened
Accounts differ on scope, and it is worth separating the two threads.
The Housing Ministry claim: per AFP as reported in S1, ZeroBytes says it took a database from the Ministry of Housing containing roughly 149 million records on property owners plus account data. That figure is an attacker claim, not a verified count, and it is not repeated by any of the established security outlets in this source set. For context on plausibility, 149 million records would substantially exceed France's population, which is consistent with a per-property or per-transaction record structure rather than 149 million distinct people, but no source in hand explains the schema. No confirmation, denial, or notification from the ministry has surfaced in these sources.
The DGFiP thread, which is fully confirmed: on 12 August 2026 a hacker using the ZeroBytes alias posted on a cybercrime forum offering a DGFiP database for sale with no listed price (Le Monde, The Record). The following evening the Finance Ministry confirmed a cyberattack and a data leak. Officials said the unauthorised access dated to late June 2026 and followed identity theft, and that the access had been severed at the end of June during a routine audit. Critically, the extraction itself went undetected at the time. Le Monde quoted the attacker directly on that point: "We were disconnected pretty quickly. The government hasn't mentioned the intrusion at all, despite clearly seeing that we were [extracting data]." TNW reports the intrusions spanned June and July, and that DGFiP did not establish that data had left its systems until the attacker said so in August.
Reuters confirmed the ministry statement covering both individuals and professionals. DGFiP said it would file a criminal complaint, notify CNIL, and contact affected users individually.
What Was Taken
The record counts across this incident cluster diverge sharply depending on who is counting, and none should be collapsed into a single number:
- ~149 million records on property owners and account data, per the ZeroBytes claim relayed by AFP in S1, attributed to the Ministry of Housing. Unverified, single lower-tier source.
- More than 2 million French taxpayers, per ZeroBytes' own forum advertisement as reported by The Register on 14 August.
- More than 600,000 people, per the ZeroBytes claim as tracked by FrenchBreaches and reported by The Record.
- 678,000 individuals and businesses, the figure produced by DGFiP's own in-depth investigation (TNW, Help Net Security). TechRepublic, citing FrenchBreaches, breaks that down as roughly 393,000 individuals and 286,000 professionals, and notes explicitly that Reuters reported the Finance Ministry has not confirmed those sub-figures.
For the DGFiP data specifically, the agency was unusually precise about content. For individuals: reference tax income, family quotient, and withholding tax rate. For companies: registered name and SIREN number. The attacker also consulted cadastral records covering property addresses and floor areas (TNW). The Record adds, via FrenchBreaches, that the claimed set includes names, tax identification numbers, email addresses, family circumstances, and tax status details. TechRepublic, citing Brussels Signal, lists names, addresses, and dates of birth among potentially exposed fields.
DGFiP was equally specific about what held: personal and professional accounts on impots.gouv.fr were not compromised, and the attacker took no taxpayer usernames and no passwords.
The cadastral access is the detail that most directly bridges the two threads. An actor already pulling property addresses and floor areas out of the tax system is an actor with demonstrated interest in French property-ownership data, which is precisely what the Housing Ministry claim describes. That is a pattern worth watching, not evidence.
Why It Matters
This is the fourth or fifth significant French public-sector breach of 2026 by The Register's count, which references cybercriminals taking 15.8 million medical records from the doctors ministry, a "secure" ID agency probing a breach with crooks claiming 19 million records, and a €42 million fine against French telcos for sub-par security preceding a 24 million customer breach. A single actor now credibly claiming a second ministry escalates that from a run of bad luck to a targeting campaign against the French state.
Three things should worry defenders more than the raw counts.
First, detection failed at the step that mattered. DGFiP cut the access during a routine audit and its access checks at that time showed no sign that data had left. The agency attributes that to the sophistication of the attack. Whatever the cause, an organisation can terminate an intrusion and still have no idea it has been robbed.
Second, the state learned it was breached from the criminal. The forum post on 12 and 13 August is what triggered the in-depth investigation that produced the 678,000 figure. Roughly six weeks elapsed between eviction and awareness.
Third, the exposed field set is close to ideal for high-credibility fraud. Reference tax income, family quotient, withholding rate, address, and floor area let an attacker construct approaches that only the tax office should be able to make. Combined with a property-owner database, the phishing quality available here is well above a typical credential dump.
The Attack Technique
There is no zero-day in this story. Bercy states the attacker used the stolen identifiers of a DGFiP employee and of an authorised third party (TNW). The attacker additionally claimed to have bypassed multi-factor authentication, a claim reported by The Register from the forum listing and echoed via Help Net Security.
The third-party angle is the structural lesson. An authorised third party here means an outside body granted a route into DGFiP systems: notaries, bailiffs, local authorities. Each such relationship widens the set of credentials that opens the door, and each sits outside the agency's direct security control.
From there, per FrenchBreaches as reported by The Record, the attacker reached internal servers, connected to the agency's VPN, and used an internal search tool to query information on individuals and businesses. Le Monde's account partially matches this, describing access to an internal DGFiP tool through a VPN. This was authorised-looking use of a legitimate query interface, which is a large part of why extraction did not trip anything.
ZeroBytes also claimed to retain access, telling buyers "I'm still logged into the panel, so if you want, you can buy it along with the database," and offered that access for sale alongside the data (The Register, TNW). DGFiP disputed the retained-access claim in its Thursday statement, saying it immediately implemented new restrictions to stop the unauthorised access and prevent further unauthorised use. On this specific point the sources are in direct conflict, and the agency statement is the higher-weight account.
What Organizations Should Do
-
Inventory and constrain third-party access paths. Enumerate every external body holding a route into your systems, including notaries, agents, contractors, and municipal partners. Scope each to the minimum data it needs, put it behind separate conditional access policy, and log it distinctly from employee access. This is the door that was used.
-
Assume MFA can be bypassed and instrument for it. Move high-value access to phishing-resistant factors (FIDO2 or certificate-based), and alert on the bypass patterns themselves: token replay, impossible travel, session cookie reuse from new device fingerprints, and MFA method registration changes.
-
Monitor query volume on internal lookup tools, not just logins. The damage here happened through legitimate authenticated use of a search interface. Baseline normal per-user query rates against citizen or customer records and alert on volumetric deviation. Access was cut in June; extraction was still invisible, because nobody was watching the tool.
-
Treat eviction and exfiltration assessment as separate workstreams. When you cut an intrusion, do not let the access review substitute for a data-loss investigation. DGFiP's checks at eviction time found nothing. Pull full query and egress logs for the entire dwell window before you conclude nothing left.
-
Rotate credentials for the identity, not just the session. Identity theft of an employee and a third party drove this. Terminate all sessions, reset all factors, and review what else those identities could reach laterally.
-
Pre-stage regulator and notification workflows. DGFiP had to file with CNIL, lodge a criminal complaint, and individually notify affected parties while still determining scope. Under GDPR the 72-hour clock runs regardless of how uncertain your record count is. Have the template, the legal contact, and the counting methodology ready before you need them.
-
Watch for the Housing Ministry claim to resolve. If your organisation touches French property-ownership, cadastral, or housing-benefit data, treat the AFP-reported claim as an active lead and check your own third-party access logs against the DGFiP timeline of late June through July 2026.
Sources: Hackers have claimed to have breached the database of France’s Mini... | France’s tax authority admits hackers made off with data on 678,000... | French taxpayers' data stolen in hack of Finance Ministry | French tax authority admits data heist after crook touts 2M ... | France investigates tax authority breach after hacker claims ... | French taxpayers' data stolen in cyber attack, ... | French Tax Authority Breach Exposes Sensitive Taxpayer Data | France’s tax agency lost data on 678,000 people to a stolen login