France’s tax authority has disclosed a data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems, saying the intrusion exposed data on 678,000 individuals and professionals.
The incident came to light after an alleged attacker using the alias “ZeroBytes” took credit on a cybercrime forum and listed a stolen database for sale.
ZeroBytes said the compromised portal contained data on about 20 million French citizens, but they only managed to extract 252,149 records containing data on more than 2 million people.
“We couldn’t finish the extraction because honestly, it’s just horrible to scrape and would have taken months. I’m still logged into the panel, so if you want, you can buy it along with the database,” they wrote. “I’m not going to sell this one for very much anyway. And as always, no mention from France about this incident.”
They said they gained access using login credentials and an MFA bypass technique.
“Upon detecting these intrusions, the French Public Finances Directorate (DGFiP) immediately suspended access to all accounts used in the identified incidents. However, the access controls carried out at that time did not reveal that these intrusions had led to data theft, due to the sophistication of the attack,” DGFiP said.
“The in-depth investigations conducted since August 12, 2026, have established that, prior to their interruption, these access points had been used to consult and extract data concerning a total of 678,000 individuals and professionals, including tax data such as reference tax income, family quotient, and withholding tax rate, and, for businesses, data such as their company name and SIREN number,” it added.
DGFiP says the online tax portals used by individuals and businesses were not compromised, and neither were their usernames or passwords. The agency has also notified the CNIL, France’s data protection authority.
DGFiP has since put additional security measures in place, including preventive shutdowns of access to sensitive systems, and is working with the finance ministry’s security office (SHFDS) and the national cybersecurity agency ANSSI.
This breach is just the latest in a run of cybersecurity incidents that have impacted multiple French government agencies in recent months.