French Tax Authority Data Breach Exposes 678,000 Individuals

France's Tax Administration Suffers Unprecedented Breach

The Direction Générale des Finances Publiques (DGFiP) — France's national tax administration, operating under the Ministry of Economy and Finance — has confirmed a significant data breach affecting 678,000 individuals and businesses. The incident, described by officials as an "unprecedented attack" on France's tax administration, was first publicly surfaced not by the government, but by the threat actor responsible.

How the Breach Occurred

The intrusion took place during June and July 2026. The attacker, operating under the alias "ZeroBytes", gained access using credentials belonging to a DGFiP tax office employee and an external contractor. ZeroBytes claims to have bypassed multi-factor authentication to reach internal servers, then used a VPN to access an internal search engine and deployed automated data extraction tools.

DGFiP says it detected and cut the unauthorized connection during routine security controls in late June — but made no public announcement at the time. Data had already been exfiltrated before access was severed.

What Was Stolen

Individual Records

Business Records

Less sensitive data was taken for businesses: SIREN registration numbers, business addresses, and the addresses of authorized representatives.

Cadastral Data

ZeroBytes also claims access to the DGFiP's Serveur Professionnel de Données Cadastrales (SPDC) — the property registry system — extracting 252,149 records corresponding to over 2 million individuals (individual records can contain multiple property holders), including property addresses and sizes.

High-Value Targets Within the Dataset

ZeroBytes published a breakdown of the stolen records that highlights particularly sensitive exposures:

This segmentation makes high-net-worth individuals especially attractive targets for follow-on fraud, impersonation, and targeted social-engineering attacks.

Timeline

What Was NOT Compromised

DGFiP confirmed that:

• The online tax portals used by individuals and businesses (impots.gouv.fr) were not compromised
• Online account usernames and passwords were not accessed
• The stolen data cannot be used to access taxpayer accounts on government portals

ZeroBytes: Profile and Motivation

ZeroBytes is not a political actor. In a direct exchange with French breach-monitoring service FrenchBreaches, the threat actor described a purely financial motivation: "Money is the main motivation, plus a desire for power."

The DGFiP intrusion represents the most significant of at least four attacks linked to this alias in 2026. The Handball Federation breach two days prior used the identical stolen-credential methodology.

Government Response

Public Accounts Minister David Amiel ordered DGFiP to begin notifying all 678,000 affected individuals from August 17, and requested a full security review with lessons-learned proposals.

DGFiP Director-General Amélie Verdier issued a public apology to taxpayers and urged those affected to be particularly cautious of unsolicited communications.

The investigation is being conducted jointly with:

• CNIL (French Data Protection Authority) — formally notified
• ANSSI (National Cybersecurity Agency of France)
• SHFDS (Ministerial Security Service)
• OFAC (Cybercrime Unit) — Paris prosecutor investigation

Risk to Affected Individuals

While online accounts are safe, the combination of income data, tax rates, addresses, and family circumstances makes the stolen dataset extremely valuable for:

1. Spear-phishing — highly convincing impersonation of DGFiP officials
2. Identity theft — full personal profile available
3. Social engineering — leveraging income data to craft targeted fraud
4. Property-based fraud — cadastral data enables real estate impersonation

If you received a notification from DGFiP: Verify any contact by visiting impots.gouv.fr directly — do not click links in emails or SMS messages. Change your impots.gouv.fr password as a precaution.

Sources

• BleepingComputer — French tax authority data breach affects 678,000 individuals
• Help Net Security — France's tax authority admits hackers made off with data on 678,000 individuals
• The Record — France investigates tax authority breach after hacker claims 600,000 victims
• The Register — French tax authority admits data heist after crook touts 2M records
• TechTimes — French Tax Agency Breach Leaks Withholding Rates as CNIL Eyes Enforcement Precedent
• CyberInsider — French tax agency confirms breach as hacker claims 2 million victims

Related Reading

• IDMerit KYC Breach: 1 Billion Records Exposed
• LexisNexis Data Breach: 400K Government Profiles