France's Tax Administration Suffers Unprecedented Breach
The Direction Générale des Finances Publiques (DGFiP) — France's national tax administration, operating under the Ministry of Economy and Finance — has confirmed a significant data breach affecting 678,000 individuals and businesses. The incident, described by officials as an "unprecedented attack" on France's tax administration, was first publicly surfaced not by the government, but by the threat actor responsible.
How the Breach Occurred
The intrusion took place during June and July 2026. The attacker, operating under the alias "ZeroBytes", gained access using credentials belonging to a DGFiP tax office employee and an external contractor. ZeroBytes claims to have bypassed multi-factor authentication to reach internal servers, then used a VPN to access an internal search engine and deployed automated data extraction tools.
DGFiP says it detected and cut the unauthorized connection during routine security controls in late June — but made no public announcement at the time. Data had already been exfiltrated before access was severed.
What Was Stolen
Individual Records
| Data Field | Description |
|---|---|
| Names | Full legal names |
| Date of Birth | Personal identifiers |
| Home Addresses | Physical addresses |
| Phone Numbers | Contact information |
| Family Circumstances | Household composition |
| Reference Taxable Income | Annual declared income |
| Withholding Tax Rates | Personalised tax deduction rates |
Business Records
Less sensitive data was taken for businesses: SIREN registration numbers, business addresses, and the addresses of authorized representatives.
Cadastral Data
ZeroBytes also claims access to the DGFiP's Serveur Professionnel de Données Cadastrales (SPDC) — the property registry system — extracting 252,149 records corresponding to over 2 million individuals (individual records can contain multiple property holders), including property addresses and sizes.
High-Value Targets Within the Dataset
ZeroBytes published a breakdown of the stolen records that highlights particularly sensitive exposures:
| Income Level | Count |
|---|---|
| Above €100,000 | 26,805 individuals |
| Above €1,000,000 | 386 individuals |
| Above €10,000,000 | 8 individuals |
This segmentation makes high-net-worth individuals especially attractive targets for follow-on fraud, impersonation, and targeted social-engineering attacks.
Timeline
| Date | Event |
|---|---|
| June–July 2026 | Intrusion occurs via stolen credentials; access cut during security audit |
| August 10, 2026 | ZeroBytes claims breach of French Handball Federation (1.3M records) using same method |
| August 12, 2026 | ZeroBytes posts stolen DGFiP database for sale on PwnForums hacking forum |
| August 13, 2026 | DGFiP and Ministry officially confirm the breach |
| August 15, 2026 | Paris prosecutor's office opens criminal inquiry; OFAC cybercrime unit engaged |
| August 17, 2026 | Full victim count of 678,000 confirmed; notification of affected individuals begins |
What Was NOT Compromised
DGFiP confirmed that:
- The online tax portals used by individuals and businesses (impots.gouv.fr) were not compromised
- Online account usernames and passwords were not accessed
- The stolen data cannot be used to access taxpayer accounts on government portals
ZeroBytes: Profile and Motivation
ZeroBytes is not a political actor. In a direct exchange with French breach-monitoring service FrenchBreaches, the threat actor described a purely financial motivation: "Money is the main motivation, plus a desire for power."
The DGFiP intrusion represents the most significant of at least four attacks linked to this alias in 2026. The Handball Federation breach two days prior used the identical stolen-credential methodology.
Government Response
Public Accounts Minister David Amiel ordered DGFiP to begin notifying all 678,000 affected individuals from August 17, and requested a full security review with lessons-learned proposals.
DGFiP Director-General Amélie Verdier issued a public apology to taxpayers and urged those affected to be particularly cautious of unsolicited communications.
The investigation is being conducted jointly with:
- CNIL (French Data Protection Authority) — formally notified
- ANSSI (National Cybersecurity Agency of France)
- SHFDS (Ministerial Security Service)
- OFAC (Cybercrime Unit) — Paris prosecutor investigation
Risk to Affected Individuals
While online accounts are safe, the combination of income data, tax rates, addresses, and family circumstances makes the stolen dataset extremely valuable for:
- Spear-phishing — highly convincing impersonation of DGFiP officials
- Identity theft — full personal profile available
- Social engineering — leveraging income data to craft targeted fraud
- Property-based fraud — cadastral data enables real estate impersonation
If you received a notification from DGFiP: Verify any contact by visiting impots.gouv.fr directly — do not click links in emails or SMS messages. Change your impots.gouv.fr password as a precaution.
Sources
- BleepingComputer — French tax authority data breach affects 678,000 individuals
- Help Net Security — France's tax authority admits hackers made off with data on 678,000 individuals
- The Record — France investigates tax authority breach after hacker claims 600,000 victims
- The Register — French tax authority admits data heist after crook touts 2M records
- TechTimes — French Tax Agency Breach Leaks Withholding Rates as CNIL Eyes Enforcement Precedent
- CyberInsider — French tax agency confirms breach as hacker claims 2 million victims