NewsCompaniesFlawsGuides
Get the app
HighClosedUpdated

French tax authority breach exposes financial records of 678,000 individuals and businesses

France's tax authority confirmed stolen records concerning 678,000 individuals and businesses. Taxpayers' passwords were not stolen. Watch for convincing tax or bank impersonation and open impots.gouv.fr directly to check messages.

What to do

If you receive a DGFiP breach notice, follow its advice and open impots.gouv.fr directly to check your account or contact the tax authority. Treat unexpected tax or bank calls and messages cautiously, even when they quote your income or family details; never provide passwords, security codes or banking details in response. DGFiP says this breach alone does not require a password change.

What’s happening

France's tax authority, DGFiP, confirmed that intruders using compromised credentials accessed or extracted records concerning 678,000 individuals and businesses. Exposed information included contact details, taxable income, withholding rates and household circumstances; property addresses and areas were also consulted. DGFiP's updated notice dates unauthorised access to June, July and August. Taxpayers' own online accounts and passwords were not compromised. Individual notifications began in August, and DGFiP filed a criminal complaint and strengthened monitoring of affected tax accounts. ZeroBytes claimed to have sold the records, but that sale was not independently verified. An 18-year-old suspect was charged and detained on 20 August. ANSSI's September findings identified weaknesses in authentication, system separation and detection, with a remediation plan agreed. As at 3 November, the sources reviewed do not establish completed remediation, recovery or deletion of the stolen records, or a conviction. Whether these records have subsequently been used in scams is not established.

What
Breach
Affects
France's tax authority (DGFiP) taxpayer and business records
Fixed in
Nothing to patch
Since
12 Aug 2026
Closed
29 Sept 2026

Timeline

  1. Update

    ANSSI published findings identifying stolen legitimate credentials, missing strong authentication, inadequate separation of systems and monitoring failures. Neither DGFiP nor ANSSI had detected the two data-extraction waves; an action plan had been agreed with DGFiP.

  2. Update

    DGFiP's updated guidance confirmed that individual notifications had begun and a criminal complaint had been filed. It also disclosed that message contents may have been stolen for fewer than 250 taxpayers, while attachments had not been viewed.

  3. Update

    An 18-year-old suspected ZeroBytes member known as ChatNoir was formally charged and remanded in custody, according to the Paris prosecutor's office as reported by Le Monde. The charges included unauthorised access and fraudulent extraction of state-held personal data.

  4. Update

    A government crisis meeting reviewed individual notifications, scheduled to start immediately afterwards. ZeroBytes told AFP it had sold the records to two buyers for thousands of euros; that claim was not independently verified.

  5. Update

    The ministry confirmed that records concerning 678,000 individuals and businesses had been accessed or extracted using compromised credentials. It said affected accounts had been blocked, additional access restrictions imposed and the CNIL notified.

  6. Update

    The Finance Ministry confirmed the breach. It said access had been blocked at the end of June, but the data theft had gone undetected.

  7. Made publicNothing to patch

    An attacker publicly claimed to have stolen French tax authority records and offered them for sale. Le Monde examined a sample containing addresses, phone numbers, taxable income, tax rates and household dependants.

Sources

  1. Accès illégitimes au système d'information de la Direction générale des Finances publiquesFrench Finance Ministry · 14 Aug 2026
  2. Vol de données suite à des accès illégitimes au système d’information de la DGFiPDGFiP · 14 Sept 2026
  3. Foire aux questions pour les particuliers : vol de données du système d’information de la DGFiPDGFiP · 24 Aug 2026
  4. L’ANSSI publie le rapport d’incident sur les cyberattaques ayant touché la DGFiPANSSI · 29 Sept 2026
  5. French taxpayers' data stolen in hack of Finance MinistryLe Monde · 14 Aug 2026
  6. French government embroiled in taxpayer data hack decried as country's 'most serious' everLe Monde · 18 Aug 2026
  7. 'ChatNoir,' the 18-year-old behind the hacking of a French tax websiteLe Monde · 7 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from August 2026 · JSON · RSS