France's Directorate General of Public Finances (DGFiP) has confirmed that an intruder accessed its information systems and extracted personal and tax data belonging to hundreds of thousands of individuals and businesses. The French Finance Ministry first acknowledged the intrusion on 13 August 2026, a day after a threat actor using the handle "ZeroBytes" listed a purported DGFiP database for sale on the PwnForums cybercrime forum. Official victim counts have moved as the investigation progressed: the ministry's initial statement put the total at 678,000 individuals and professionals (BleepingComputer, RFI, The Record), while DGFiP's later FAQ pegs the figure at roughly 600,000 (The Register). The authority has not explained the discrepancy. ZeroBytes, for their part, claimed more than 2 million records, a figure no official source supports.
What Happened
According to the Economy Ministry statement carried by Reuters, The Record and The Register, a "malicious actor" gained unauthorised access to DGFiP systems in late June 2026 following what the ministry described as identity theft. That access was severed in late June during a routine audit, before the agency knew it was dealing with an attacker. The incident only became public on 12 August, when ZeroBytes advertised the stolen database and additionally claimed to still hold live access to DGFiP's environment and offered to sell it. DGFiP publicly disputed the continued-access claim, and said it immediately imposed new restrictions and shut down access to sensitive information systems on learning of the post.
Accounts differ on how many intrusions occurred. RFI reports that DGFiP confirmed two separate intrusions, one in late June and a second in late July. The English-language wires and security press (Reuters, The Record, BleepingComputer, The Register) describe only the late-June access. Treat the second July intrusion as reported by RFI rather than as an established fact until DGFiP addresses it directly.
The response escalated quickly. DGFiP notified France's data protection regulator CNIL and brought in the national cybersecurity agency ANSSI to help scope the damage. The Paris Public Prosecutor's cybercrime unit opened a criminal investigation, handing it to France's anti-cybercrime office (Ofac), covering fraudulent extraction of data from a state-operated personal information system and suspected criminal conspiracy to prepare an offence carrying at least five years' imprisonment. RFI reports that Prime Minister Sébastien Lecornu convened an emergency interministerial meeting, after which DGFiP began sending individual warning emails on the evening of Monday 17 August, continuing through that week. Tax officials characterised the attack as more sophisticated and more complex than previous incidents they had faced.
What Was Taken
The exposed data breaks into several tiers of sensitivity, and the sourcing is clearest in DGFiP's own updated FAQ as reported by The Register.
For individual taxpayers, roughly 350,000 people per The Register, the compromised set includes full names, tax identification numbers, marital status, email and postal addresses, and phone numbers, alongside genuinely sensitive fiscal detail: household composition, number of dependents, family quotient, reference tax income (revenu fiscal de référence) and withholding tax rates. Amélie Verdier, Director-General of Public Finances, confirmed the names, family quotient, reference taxable income and withholding rate elements to RFI. TechRepublic, citing reporting by Brussels Signal, adds dates of birth to that list, which is a single lower-tier attribution and should be treated as unconfirmed.
The most invasive element is the secure messaging exposure. DGFiP said lists of messages exchanged between taxpayers and the agency were accessed, and that for approximately 250 people the actual message contents were exposed. RFI puts it at fewer than 250 cases. Those messages routinely contain hardship pleas, divorce and inheritance details, and disputes over assessments.
For businesses and professionals, roughly 250,000 entities per The Register, the exposure was limited to company names and SIREN numbers, the nine-digit French business identifiers. TechRepublic cites the monitoring platform FrenchBreaches for a different split of the 678,000 total: approximately 393,000 individuals and 286,000 professionals, figures Reuters noted the Finance Ministry has not confirmed. That split does not reconcile with DGFiP's own 350,000 plus 250,000 breakdown, which is another reason the headline totals should be read as approximate.
Cadastral data was also touched. BleepingComputer reports ZeroBytes claimed access to the Serveur Professionnel de Données Cadastrales (SPDC), DGFiP's land registry platform, which they said exposed data on roughly 20 million French citizens but from which they claimed to have actually extracted 252,149 records. RFI reports around 200,000 land registry accounts were affected. DGFiP's position is that the cadastral exposure was limited to property addresses and dimensions, information already in the public domain.
DGFiP has been consistent on what was not taken: user IDs and passwords were not compromised, online accounts on impots.gouv.fr were not accessed, and tax returns and tax notices themselves were not exposed. The agency states the stolen data cannot be used to log into taxpayer accounts.
Why It Matters
This is a credential-and-identity compromise of a trusted government system, not a ransomware event, and the downstream risk is fraud rather than disruption. The combination of verified identity, exact reference tax income, family quotient, number of dependents and withholding rate gives a social engineer everything needed to sound authoritative on a cold call. A caller who can state your household composition and your exact taxable income is not going to be dismissed as a scammer by most people. DGFiP's own notifications explicitly warn that the stolen details make phishing more convincing, and the warning letters urge recipients to be sceptical of anyone claiming familiarity based on that data.
There is a compounding factor. This is one entry in a run of French public sector breaches this year, following incidents at the health, identity and telecom sectors reported by The Register. Each successive leak makes fraudulent contact easier to corroborate against previously stolen data, and erodes the assumption that a caller who knows your details must be legitimate. That is a systemic problem no single agency can remediate.
For defenders elsewhere, the more instructive point is the detection gap. The intrusion happened in late June, the access path was closed in late June as an incidental result of an audit, and nobody at DGFiP identified it as an attack until a criminal posted the loot on a forum on 12 August. The control that stopped the bleeding worked; the control that should have raised an alarm did not.
The Attack Technique
Full technical detail has not been published, and the specifics below come largely from the attacker's own forum claims, which should be weighted accordingly.
ZeroBytes claimed to The Register's reporting that they obtained access using stolen credentials combined with an MFA bypass technique. DGFiP's official framing is consistent in shape if not in vocabulary: the ministry attributes the access to "identity theft" (usurpation d'identité), meaning the attacker authenticated as a legitimate user rather than exploiting a software vulnerability. There is no indication in any source of malware deployment, remote code execution or a named CVE.
Once inside, the activity described is bulk data consultation and extraction through legitimate application interfaces, including the SPDC land registry platform, rather than database exfiltration at the infrastructure layer. That is why passwords were never at risk but tax data was: the attacker was querying applications with a valid user's authority. The attacker's claim that they could reach around 20 million citizens' records through SPDC but only pulled 252,149 suggests rate limiting, session constraints or self-imposed operational limits rather than a hard access boundary, which is a meaningful distinction for anyone modelling worst-case exposure of a similar portal.
ZeroBytes' claim of retained access has been explicitly denied by DGFiP, which says the path was cut at the end of June and further restrictions were applied in August.
What Organizations Should Do
- Treat MFA as bypassable and instrument accordingly. Phishing-resistant factors (FIDO2 or WebAuthn hardware keys, certificate-based auth) should be mandatory for any account that can query bulk citizen or customer data. Where you cannot get there yet, add device binding and session token validation so a stolen cookie or an intercepted OTP does not equal a session.
- Put volumetric alerting on business-logic access, not just infrastructure. DGFiP's attacker used valid credentials against a legitimate application. Baseline how many records each role queries per hour and alert on deviation. A single account pulling six figures of records is an incident regardless of whether the credential was valid.
- Close the audit-to-detection loop. The access here was reportedly cut during an audit without anyone recognising it as an intrusion. When an audit or access review terminates a session or revokes a credential, that event should generate a triage ticket and a look back through the logs, not just a config change.
- Retain and review authentication and query logs for at least 12 months. The gap between the June intrusion and the August disclosure is precisely the window where short log retention destroys the ability to scope a breach. DGFiP could reconstruct what was taken because the telemetry survived.
- Segment high-value bulk data portals. A land registry interface that can theoretically serve 20 million records to one authenticated session is a design problem. Enforce per-session and per-day query ceilings, and require step-up authentication or explicit approval for bulk export.
- Monitor criminal forums for your own data. This breach was surfaced by a forum listing, not by internal detection. Dark web and forum monitoring is a poor substitute for detection, but it is a real backstop, and it buys days of lead time on the notification and regulator clock.
- Pre-write the fraud-warning playbook. Where stolen data enables impersonation rather than account takeover, the primary mitigation is customer communication. DGFiP's line, that it will never ask for information outside the secure online account, is the right template: a clear, absolute, memorable rule that recipients can apply without judgement.
Sources: French tax authority says break-in exposed data of 600K, including... | French tax authority data breach affects 678,000 individuals | French tax authority admits data heist after crook touts 2M records | France investigates tax authority breach after hacker claims 600,00... | French taxpayers' data stolen in cyber attack ... | Warnings sent to French taxpayers after hackers allegedly sell stol... | France probes unprecedented cyberattack after tax data of 678,000 u... | French Tax Authority Breach Exposes Sensitive Taxpayer Data