French Tax Authority Data Breach Hits 678,000 Taxpayers and Firms

The French tax authority has confirmed a data breach that exposed income and property records belonging to 678,000 individuals and businesses. Officials at the Direction générale des Finances publiques, known as DGFiP, traced the intrusion to late June 2026. An attacker used the stolen identity of a person who held legitimate access to internal systems. The agency cut that access within days, but it did not know records had left the building until a criminal forum listing appeared seven weeks later.

How the French Tax Authority Learned About the Data Breach

A threat actor using the handle ZeroBytes claimed the attack on 12 August, listing a DGFiP database for sale on the PwnForums hacking forum.That post triggered the investigation that produced the official figures. The French tax authority had already interrupted the fraudulent access during an inspection at the end of June, yet its own controls never flagged the data breach. The agency learned the scale of the theft from the person who carried it out.

Investigators then established that the attacker consulted and extracted records covering 678,000 individuals and professionals. The ministry notified CNIL, the national data protection regulator. ANSSI, France's cybersecurity agency, is assisting with the technical assessment. DGFiP has also shut down access to sensitive information systems while that workcontinues.

Notifications go out this week. Affected people and businesses will receive an email or a letter. Each notice sets out which records the attacker may have viewed, along with the precautions to follow.

What the Attacker Took From DGFiP Systems

The French tax authority set out the exposed fields when it disclosed the data breach. For individuals, the attacker reached reference tax income, family quotient, and withholding tax rate. For businesses, the haul covers company names and SIREN registration numbers. Cadastral records also came into scope, exposing property addresses and building sizes.

Online tax accounts survived intact. The ministry stated that user IDs and passwords stayed out of the attacker's hands, so nobody can log into impots.gouv.fr with what ZeroBytes took.

That reassurance goes only so far. None of the stolen fields sit in the public domain, and none of them can be reset. A person cannot request a fresh withholding rate history the way they would change a compromised password.

Why the Stolen Records Fuel Convincing Scams

Impersonation scams work when the caller knows something only the real institution should know. The data breach at the French tax authority handed criminals exactly that material. A fraudster who cites a target's correct reference income and withholding rate sounds official, because the numbers check out.

The combination matters more than any single field. Income, household composition, and property size together describe a household's finances with precision. Criminals rarely obtain figures of that quality, and they will pay for them.

The attacker's own claims sharpen the concern. ZeroBytes allegedly published a breakdown identifying more than 26,000 people with reference incomes above €100,000, several hundred above €1 million, and eight above €10 million. DGFiP has not verified any of those numbers.

Reported figures for the first half of 2026 already placed France at the centre of Europe's physical attacks on cryptocurrency holders. Property data attaches an address to a wealth signal.

The Attacker's Wider Claims

ZeroBytes claims the compromised portal was the SPDC, the professional server that feeds France's central land registry. Access there would touch records on roughly 20 million citizens. The threat actor says the extraction stopped at 252,149 records covering more than 2 million people, because scraping the rest would have taken months. ZeroBytes also claims to have remained logged into the panel afterwards.

None of that carries official confirmation. The French tax authority has restricted its data breach statement to the 678,000 figure and gone no further. That distance between the confirmed count and the claimed one remains the open question in this case.

A Pattern Across French Public Institutions

This data breach at the French tax authority follows a run of incidents across the country's public sector. Regulators fined the national employment agency €5 million in January 2026 after attackers stole personal data on 43 million people. One month later, the national bank account registry FICOBA lost records covering more than 1.2 million account holders.

The FICOBA case ran on the same route: credentials belonging to an authorised user, not a software flaw. The agency behind French identity documents and the government's own encrypted messaging platform both suffered breaches earlier in 2026. Attackers keep finding that a valid login opens more doors than an exploit.

Prime Minister Sébastien Lecornu has since chaired an interministerial crisis cell on the incident. He asked ANSSI to audit the breach and establish its causes, then ordered a separate security review of DGFiP systems, with operational conclusions expected in September. A judicial investigation is running alongside.

What Comes Next for Affected Taxpayers

Anyone contacted by DGFiP should treat follow-up messages with suspicion. Genuine notifications arrive by post or email and never request payment details, passwords, or bank information. Taxpayers who want to check their account should open the official portal directly instead of clicking a link.

The wider lesson sits with the detection failure. Stolen credentials from a trusted user walk straight past perimeter defences, so organisations need monitoring that flags unusual query volumes from valid accounts. The French tax authority stopped the intruder in June but could not tell that a data breach had happened, and that blind spot cost it seven weeks.

September's audit findings will show how far the French tax authority has closed the gaps this data breach exposed. For now, 678,000 people wait on a letter explaining what a stranger already knows about their finances.