Government Infrastructure Breach: 678,000 Impacted by French Tax Authority DGFiP Data Breach
Executive Summary
France's national tax administration, the Directorate General of Public Finances (Direction Générale des Finances Publiques - DGFiP), officially confirmed a major cybersecurity breach on August 17–18, 2026, exposing the confidential records of 678,000 individual taxpayers and businesses. The incident emerged after a threat actor operating under the pseudonym "ZeroBytes" advertised access to internal DGFiP administrative databases on cybercrime forums. Attackers leveraged compromised employee and third-party accounting credentials to extract reference tax incomes, withholding tax rates, corporate tax identifiers (SIREN/SIRET), and real estate property records.
Technical Breakdown of the French Tax Administration Incident
The breach highlights persistent credential-stuffing and supply chain access vulnerabilities in government tax portals:
1. Compromised Third-Party Credentials & MFA Bypass Techniques
Forensic investigations conducted with France's cybersecurity agency ANSSI mapped the attack vectors:
* The Access Mechanism: Threat actors obtained valid authentication credentials belonging to a tax agency employee and an authorized third-party accounting vendor, utilizing session hijacking to access internal administrative consultation portals throughout June and July 2026.
* Stolen Fiscal & Real Estate Datasets: The exfiltrated records contain reference annual tax incomes, applicable withholding rates, registered business names, unique business identification numbers (SIREN/SIRET), and cadastral property surface areas.
2. Containment Measures, Regulatory Notification & Scrape Thwarting
The agency executed immediate defensive countermeasures upon detecting anomalous database extraction:
* Session Termination & Account Deactivation: DGFiP severed all compromised account credentials, restricted external portal access routes, and notified the French data protection authority (CNIL).
* Mass Scraping Limitations: While the attacker claimed the compromised system contained records for over 20 million citizens, DGFiP's internal portal architecture and anti-scraping limits prevented full database exfiltration, capping the exfiltrated dataset at 678,000 records.
Incident Attribute
Details
Victim Entity
Directorate General of Public Finances (DGFiP - France)
Disclosed Date
August 17–18, 2026 (Intrusions Detected June – July 2026)
Threat Actor
"ZeroBytes" (Extortion Forum Broker)
Affected Individuals
678,000 Taxpayers and Registered Businesses
Compromised Data
Reference Tax Incomes, Withholding Tax Rates, Business SIREN/SIRET Numbers, Cadastral Real Estate Data
Unaffected Information
Passwords, Direct Bank Account Numbers (IBAN), Core Tax Portal Credentials
Public Sector Identity Fraud & Targeted Spear-Phishing Exposure
Government tax breaches present severe secondary risks for citizens and enterprises. While direct account passwords were not exfiltrated, reference tax incomes and property holdings provide cybercriminals with authoritative data points to execute convincing spear-phishing campaigns, corporate identity theft, and fraudulent tax rebate claims.
Government agencies must enforce continuous conditional access policies and phishing-resistant hardware tokens across all employee and contractor accounts.
Recommendations and Mitigations
Taxpayers, French business entities, and government IT administrators should adopt key defensive safeguards:
1. Beware of Phishing Emails Impersonating DGFiP or Tax Officials: Never click links in emails claiming urgent tax audits, recalculations, or direct bank transfer requests; verify all communications via impots.gouv.fr.
2. Mandate FIDO2/WebAuthn Hardware MFA for All Administrative Portals: Eliminate SMS- and mobile push-based MFA for government contractor and employee accounts in favor of physical cryptographic security keys.
3. Implement Behavioral Anomaly Detection on Mass Database Queries: Configure SIEM alerting rules to flag abnormal sequential record consultations or high-volume data scraping on public administration portals.
4. Monitor Business Credit Profiles & Corporate Registration Filings: French enterprises should monitor SIREN/SIRET registry records for unauthorized corporate identity modifications or fraudulent credit applications.