France tax authority breach exposes data of 680,000

The Directorate General of Public Finances (DGFiP) reported a breach that exposed information on roughly 680,000 people after attackers used compromised credentials for an employee account and a third-party account to access its systems in June and July. The authority says it suspended the unauthorized access as soon as it was detected. The incident came to light after a threat actor posted on a hacking forum claiming to have accessed DGFiP systems.

DGFiP initially found no sign of data exfiltration, but a later investigation confirmed that information for about 678,000 users had been taken. The agency notified France’s data protection authority, CNIL.

The exposed information includes reference tax income, withholding tax rates, company names and unique identifiers, and cadastral details such as real-estate addresses and surface areas. Usernames and passwords were not among the compromised fields, and DGFiP reports no other categories of data affected based on current findings.

The tax authority is continuing its investigation to establish the full scope and to determine how the credentials were obtained. It will contact each affected person directly to explain what was accessed and to outline recommended next steps.

DGFiP reviewed logs and account activity after the forum post and says it suspended the access immediately. The authority is assessing whether additional security controls or remediations are required.

The incident follows a separate cyberattack last month on Romania’s National Agency for Cadastre and Property Registration (ANCPI). That attack involved theft of employee credentials and internal documents, an extortion attempt and the wiping of encrypted data after demands were not met. ANCPI rebuilt servers and restored services over several weeks; the central cadastral database of property rights was not affected.

DGFiP has said it will provide updates as the investigation proceeds and has notified the relevant supervisory authority.