The Tax Office That Lost Count: France’s DGFiP Breach and the Arithmetic of a Public-Sector Bad Year- 344
August 20, 2026
France’s tax administration spent a week in August revising the size of its own breach. An intruder who entered the systems of the Directorate General of Public Finances in late June, using a stolen or misused identity, was able to query and extract data on individuals and businesses before the access was cut, and the agency only went public after a hacker calling himself “ZeroBytes” advertised the haul on a cybercrime forum. Since then, three numbers have circulated: the attacker’s two million, the authority’s own 678,000, and a final 600,000 that the DGFiP has not reconciled with its first estimate. What the episode reveals is less a sophisticated intrusion than a familiar failure mode, an identity-based entry into an internal tool built for routine searches, landing on a state already reeling from a year of breaches across its secure-documents agency, its bank-account register, its health suppliers and its government messaging platform.
The sequence began on Wednesday, 12 August, when ZeroBytes posted a purported database of more than two million French taxpayers, claiming to have entered with stolen credentials and a technique to bypass multi-factor authentication, and offering to sell continued access to the agency’s systems alongside the data. The DGFiP’s statement the next day confirmed the core of the claim while contesting its most alarming element: an unauthorized access, “following identity theft” at the end of June, had been severed that same month during an audit, but had “nevertheless allowed the consultation and extraction of data concerning individuals and professionals.” The authority said it had imposed new restrictions after the forum post, would notify the CNIL, France’s data-protection regulator, and would file a criminal complaint. According to FrenchBreaches, which tracks French leaks, the attacker described reaching internal servers, connecting through the agency’s VPN and using an internal search tool to look up individuals and companies, extracting data until the connection was cut. None of these technical claims has been independently verified, and the DGFiP has attributed the breach to no one.
The cybercrime section of the Paris prosecutor’s office opened an investigation and handed it to OFAC, France’s specialist cybercrime office, while tax officials described the attack as more complex than anything they had previously faced. Public Accounts Minister David Amiel ordered notifications to begin and asked for proposals to tighten security procedures. The first official figure, 678,000 affected “individuals and professionals,” was revised a week later when the DGFiP published an FAQ setting the total at roughly 600,000, divided between slightly more than 350,000 individuals and about 250,000 businesses and professionals. The authority did not explain the gap between its two figures, nor between either and the attacker’s claims, which ranged from “more than 600,000” in the account relayed by FrenchBreaches to more than two million in the forum advertisement.
The composition of the stolen data matters more than the headline count. For individuals, the exposure covers tax identification numbers, marital status, email and postal addresses and telephone numbers, together with the components of the household tax file: household composition, number of dependants, the family quotient, reference tax income and the withholding rate. The DGFiP also disclosed that lists of messages exchanged with the authority were exposed, and that for around 250 people the contents of those messages were taken as well. For businesses, the data was limited to company names, SIREN registration numbers and the addresses of authorised representatives, and the cadastral records involved held only property addresses and dimensions already in the public domain.
The agency stresses that none of this grants access to taxpayers’ secure accounts on impots.gouv.fr, but that reassurance addresses the wrong threat. Income, tax rate and family situation are precisely what turns a generic phishing message or phone call into a credible one, and the DGFiP’s own notifications warn of bogus bank advisers, chief-executive fraud and impersonation attempts, and remind recipients that the administration never requests PINs or identity documents by phone, text or email. Days later, the authority also suspended its Vacant Successions Portal after discovering a “technical vulnerability,” with no evidence so far of data leaving that system.
The breach is the latest entry in an unusually dense year for the French state. In February the finance ministry, which oversees the DGFiP, admitted that attackers using stolen credentials had accessed the national register of bank accounts and taken around 1.2 million records. In March the health ministry confirmed the theft of 15.8 million administrative files from the healthtech supplier Cegedim Santé, some 165,000 of them containing doctors’ notes. In April the secure-documents agency France Titres, formerly ANTS, was breached by an attacker reportedly aged fifteen who claimed to hold data on 18 to 19 million people, while the education ministry disclosed an attack on a student-account system; in June investigators began examining claims of a compromise of Tchap, the government’s encrypted messaging service, involving 73,000 accounts and 643,000 messages.
Reporting has also linked a breach at INSEE, the national statistics office, to the same period, and police earlier arrested a twenty-year-old suspected of dozens of intrusions against public bodies, sports federations and companies. The common thread across most of these cases is not exotic tradecraft but access obtained with valid or stolen identities into systems designed to be searched by insiders, which is why the DGFiP’s discovery of the June intrusion during an audit, rather than through real-time detection, may prove the more instructive detail.
