{"id":"french-taxpayer-financial-data-breach-aug-2026","category":"breach","status":"closed","title":"French tax authority breach exposes financial records of 678,000 individuals and businesses","tldr":"France's tax authority confirmed stolen records concerning 678,000 individuals and businesses. Taxpayers' passwords were not stolen. Watch for convincing tax or bank impersonation and open impots.gouv.fr directly to check messages.","summary":"France's tax authority, DGFiP, confirmed that intruders using compromised credentials accessed or extracted records concerning 678,000 individuals and businesses. Exposed information included contact details, taxable income, withholding rates and household circumstances; property addresses and areas were also consulted. DGFiP's updated notice dates unauthorised access to June, July and August. Taxpayers' own online accounts and passwords were not compromised. Individual notifications began in August, and DGFiP filed a criminal complaint and strengthened monitoring of affected tax accounts. ZeroBytes claimed to have sold the records, but that sale was not independently verified. An 18-year-old suspect was charged and detained on 20 August. ANSSI's September findings identified weaknesses in authentication, system separation and detection, with a remediation plan agreed. As at 3 November, the sources reviewed do not establish completed remediation, recovery or deletion of the stolen records, or a conviction. Whether these records have subsequently been used in scams is not established.","action":"If you receive a DGFiP breach notice, follow its advice and open impots.gouv.fr directly to check your account or contact the tax authority. Treat unexpected tax or bank calls and messages cautiously, even when they quote your income or family details; never provide passwords, security codes or banking details in response. DGFiP says this breach alone does not require a password change.","product":"France's tax authority (DGFiP) taxpayer and business records","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["france","dgfip","data-breach","financial-data","identity-theft"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Accès illégitimes au système d'information de la Direction générale des Finances publiques","url":"https://presse.economie.gouv.fr/acces-illegitime-au-systeme-dinformation-de-la-direction-generale-des-finances-publiques/","by":"French Finance Ministry","date":"2026-08-14"},{"kind":"advisory","title":"Vol de données suite à des accès illégitimes au système d’information de la DGFiP","url":"https://www.impots.gouv.fr/actualite/vol-de-donnees-suite-des-acces-illegitimes-au-systeme-dinformation-de-la-dgfip","by":"DGFiP","date":"2026-09-14"},{"kind":"advisory","title":"Foire aux questions pour les particuliers : vol de données du système d’information de la DGFiP","url":"https://www.impots.gouv.fr/sites/default/files/media/2_actu/2026-08_acces_illegitime_donnees/faq_acces_illegitime_donnes_fiscales_particuliers.pdf","by":"DGFiP","date":"2026-08-24"},{"kind":"advisory","title":"L’ANSSI publie le rapport d’incident sur les cyberattaques ayant touché la DGFiP","url":"https://cyber.gouv.fr/actualites/lanssi-publie-le-rapport-dincident-sur-les-cyberattaques-ayant-touche-la-dgfip/","by":"ANSSI","date":"2026-09-29"},{"kind":"news","title":"French taxpayers' data stolen in hack of Finance Ministry","url":"https://www.lemonde.fr/en/pixels/article/2026/08/14/french-taxpayers-data-stolen-in-hack-of-finance-ministry_6756510_13.html","by":"Le Monde","date":"2026-08-14"},{"kind":"news","title":"French government embroiled in taxpayer data hack decried as country's 'most serious' ever","url":"https://www.lemonde.fr/en/politics/article/2026/08/18/french-government-embroiled-in-taxpayer-data-hack-decried-as-country-s-most-serious-ever_6756624_5.html","by":"Le Monde","date":"2026-08-18"},{"kind":"news","title":"'ChatNoir,' the 18-year-old behind the hacking of a French tax website","url":"https://www.lemonde.fr/en/france/article/2026/09/07/chatnoir-the-18-year-old-behind-the-hacking-of-a-french-tax-website_6757230_7.html","by":"Le Monde","date":"2026-09-07"}],"started":"2026-08-12","closed":"2026-09-29","created":"2026-11-03T20:40:00.203Z","updated":"2026-11-03T20:40:00.203Z","cve_notes":[],"timeline":[{"at":"2026-09-29","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"ANSSI published findings identifying stolen legitimate credentials, missing strong authentication, inadequate separation of systems and monitoring failures. Neither DGFiP nor ANSSI had detected the two data-extraction waves; an action plan had been agreed with DGFiP.","url":"https://cyber.gouv.fr/actualites/lanssi-publie-le-rapport-dincident-sur-les-cyberattaques-ayant-touche-la-dgfip/","by":"ANSSI","patch":null},{"at":"2026-08-24","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"DGFiP's updated guidance confirmed that individual notifications had begun and a criminal complaint had been filed. It also disclosed that message contents may have been stolen for fewer than 250 taxpayers, while attachments had not been viewed.","url":"https://www.impots.gouv.fr/sites/default/files/media/2_actu/2026-08_acces_illegitime_donnees/faq_acces_illegitime_donnes_fiscales_particuliers.pdf","by":"DGFiP","patch":null},{"at":"2026-08-20","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"An 18-year-old suspected ZeroBytes member known as ChatNoir was formally charged and remanded in custody, according to the Paris prosecutor's office as reported by Le Monde. The charges included unauthorised access and fraudulent extraction of state-held personal data.","url":"https://www.lemonde.fr/en/france/article/2026/09/07/chatnoir-the-18-year-old-behind-the-hacking-of-a-french-tax-website_6757230_7.html","by":"Le Monde","patch":null},{"at":"2026-08-17","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"A government crisis meeting reviewed individual notifications, scheduled to start immediately afterwards. ZeroBytes told AFP it had sold the records to two buyers for thousands of euros; that claim was not independently verified.","url":"https://www.lemonde.fr/en/politics/article/2026/08/18/french-government-embroiled-in-taxpayer-data-hack-decried-as-country-s-most-serious-ever_6756624_5.html","by":"Le Monde","patch":null},{"at":"2026-08-14","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"The ministry confirmed that records concerning 678,000 individuals and businesses had been accessed or extracted using compromised credentials. It said affected accounts had been blocked, additional access restrictions imposed and the CNIL notified.","url":"https://presse.economie.gouv.fr/acces-illegitime-au-systeme-dinformation-de-la-direction-generale-des-finances-publiques/","by":"French Finance Ministry","patch":null},{"at":"2026-08-13","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"The Finance Ministry confirmed the breach. It said access had been blocked at the end of June, but the data theft had gone undetected.","url":"https://www.lemonde.fr/en/pixels/article/2026/08/14/french-taxpayers-data-stolen-in-hack-of-finance-ministry_6756510_13.html","by":"Le Monde","patch":null},{"at":"2026-08-12","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"An attacker publicly claimed to have stolen French tax authority records and offered them for sale. Le Monde examined a sample containing addresses, phone numbers, taxable income, tax rates and household dependants.","url":"https://www.lemonde.fr/en/pixels/article/2026/08/14/french-taxpayers-data-stolen-in-hack-of-finance-ministry_6756510_13.html","by":"Le Monde","patch":"na"}],"url":"https://hard.fyi/live/french-taxpayer-financial-data-breach-aug-2026/","json":"https://hard.fyi/api/live?id=french-taxpayer-financial-data-breach-aug-2026"}