A data breach at the French tax authority has compromised the personal information of 678,000 taxpayers, raising concerns about potential phishing scams.
The French tax authority, DGFiP, has reported a significant data breach affecting 678,000 taxpayers, revealing sensitive information such as income details and property addresses.
Overview of the Breach
Between June and July 2026, a hacker exploited credentials from a tax office employee and a contractor to gain unauthorized access to internal servers. The attacker utilized a Virtual Private Network (VPN) to navigate the security systems, executing an automated data extraction process that could only be stopped by severing their access.
Upon notice of irregular activities, DGFiP acted to deactivate the compromised accounts; however, the initial investigation failed to identify the breach due to the sophisticated nature of the attack. The hacker accessed crucial tax data, including reference incomes, withholding tax rates, and details regarding companies, while also viewing cadastral information such as property sizes and addresses.
Importantly, DGFiP confirmed that taxpayer account details, including usernames and passwords, were not compromised during the breach.
The breach came to light on August 12 when an individual known as ZeroBytes posted the database for sale on a criminal forum for thousands of euros, claiming to have extracted 678,438 records. The hacker even shared screenshots suggesting access to private tax information, raising concerns about the extent of the breach.
"While the DGFiP insists accounts weren't compromised, I have proof of access to private data and 6,366,056 requests available."
— ZeroBytes
An analysis conducted by the site FrenchBreaches revealed that the database includes records on 392,867 individuals and 285,570 legal entities, with a notable number of high-income earners among them.
Investigation and Future Risks
DGFiP has begun notifications to affected parties and is collaborating with law enforcement and data protection authorities such as CNIL. The Paris prosecutor's office has also launched its investigation into the incident. The potential implications for increased ransomware attacks, particularly targeting cryptocurrency holders, are concerning. France has seen a rise in wrench attacks as attackers exploit knowledge of victims' income levels and addresses, a situation exacerbated by the recent data leak.
Although this breach does not directly contain information about cryptocurrency holdings, analysts have indicated it could lead to an uptick in phishing scams aimed at those affected.
