# French Tax Authority Breach Exposes Data on 678,000 People Page: https://hirantha.me/blog/french-tax-authority-breach-exposes-data-on-678000-people Published: 2026-08-19 Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom Topics: dgfip, data breach, france, tax data, credential theft > Stolen employee credentials let a hacker pull tax and property records on 678,000 French individuals and businesses from DGFiP. ## A credential theft, not a software flaw France's tax authority, the Direction Generale des Finances Publiques (DGFiP), has confirmed that an intruder accessed its systems and extracted records on 678,000 individuals and businesses. The entry point was not a software bug. According to DGFiP, the attacker used compromised or impersonated login credentials belonging to one of its own employees and to an authorized third party, then browsed internal systems as if they belonged there. That distinction matters. A patchable flaw can be closed with an update. A credential-based intrusion means the agency now has to assume its access logs, its identity checks, and its third-party account management all need a harder look, not just its code. At least one outlet covering the disclosure reported that the credentials were paired with a technique to get around multi-factor authentication (MFA), the second-step verification that is supposed to stop a stolen password alone from being enough to log in. If that detail holds up, it points to a more capable intrusion than a simple phished password, since defeating MFA generally requires either tricking the victim into approving a login prompt or intercepting a one-time code in real time, not just guessing or buying a credential off a dark-web list. ## What was taken, and what was not For individuals, the exposed records include reference tax income, family quotient, and the individual withholding tax rate DGFiP applies to their pay. For businesses, the intruder pulled company names and SIREN numbers, the unique identifier France's business registry (Systeme d'Identification du Repertoire des Entreprises, or SIREN) assigns to every registered company. A separate set of cadastral records, covering property addresses and surface areas, was also accessed. DGFiP has said the usernames and passwords tied to citizens' own online tax accounts were not part of the breach, and that those accounts remain secure. The stolen data describes people; it does not grant anyone a way to log in as them. ## A second, unverified claim The person behind the breach, using the handle ZeroBytes, listed the DGFiP data for sale on the hacking forum PwnForums around August 12 and 13. Separately, ZeroBytes claimed to have also broken into France's land registry platform and to have pulled records covering roughly 2 million people there, though only 252,149 records were actually extracted, with the attacker reportedly saying the rest would have taken months to scrape. That second claim has not been confirmed by DGFiP or independently verified. It is worth reporting because it shows the scale the attacker says was available, but readers should treat the 678,000 figure, the one DGFiP has actually confirmed, as the number that matters right now. ## Timeline DGFiP says the unauthorized access took place during June and July 2026. It surfaced publicly when ZeroBytes began advertising the stolen data in mid-August, and DGFiP issued a press release confirming the breach on August 14. The agency has not said exactly when its own internal monitoring first flagged the intrusion, only that once it did, it moved to cut off the compromised accounts. ## The response DGFiP disabled the affected accounts, disconnected some sensitive systems as a precaution, and notified the Commission Nationale de l'Informatique et des Libertes (CNIL), France's data protection regulator. It is coordinating its investigation with the Agence Nationale de la Securite des Systemes d'Information (ANSSI), the national cybersecurity agency, the Ministry of Economy and Finance, and the High Official for Defense and Security. The agency also plans to file a criminal complaint and says it will contact affected individuals and businesses directly by letter or email. ## What it means in practice If you file French taxes or own property in France, the practical risk is not account takeover, it is phishing. The data exposed here, accurate income brackets, withholding rates, family situations, and property details, is exactly what makes a scam email convincing. A message that already knows your withholding rate or your family quotient will read as legitimate to a lot of people who would otherwise ignore it. DGFiP's own notifications will arrive by letter or email in the weeks following the disclosure. Treat any unsolicited message that references specific tax or property figures with suspicion, and verify anything claiming to be from DGFiP through the agency's official channels rather than a link in the message itself. The agency has said your login credentials are safe; anyone asking you to re-enter them in response to this breach is not really DGFiP. For organizations elsewhere reading this as a cautionary example, the more transferable lesson is about third-party access. The intrusion did not come through DGFiP's own workforce alone; an authorized outside party's credentials were part of how the attacker got in. Any agency or company that grants system access to contractors, vendors, or partner organizations is only as protected as the weakest identity check on that extended list, regardless of how well-defended its own employee accounts are. ## Questions **Was my DGFiP login password stolen?** No. DGFiP says usernames and passwords for citizens' own online tax accounts were not part of this breach and remain secure. **Who carried out the attack?** A hacker using the alias ZeroBytes has claimed responsibility and listed the data for sale, but no group or nation has been formally attributed. **How did the attacker get in?** Through compromised or impersonated login credentials belonging to a DGFiP employee and an authorized third party, not a software vulnerability. **Is the claim of 2 million land-registry records confirmed?** No. That figure comes from the attacker's own unverified claim about a separate land-registry system; DGFiP has only confirmed 678,000 affected individuals and businesses. **What should affected people do now?** Watch for phishing messages that reference accurate tax or property details, and verify any communication claiming to be from DGFiP through its official channels rather than links in the message. ## Sources - [French tax authority data breach affects 678,000 individuals](https://www.bleepingcomputer.com/news/security/french-tax-authority-data-breach-affects-678-000-individuals/), BleepingComputer - [France's tax authority admits hackers made off with data on 678,000 individuals](https://www.helpnetsecurity.com/2026/08/17/france-tax-authority-data-breach/), Help Net Security - [DGFiP Cyberattack Exposes Tax And Cadastral Data](https://thecyberexpress.com/dgfip-cyberattack-exposes-data/), The Cyber Express - [French Tax Authority Data Breach Exposes 600,000+ Users' Personal Tax-Related Data](https://cybersecuritynews.com/french-tax-authority-data-breach/), Cybersecurity News