French tax authority admits data heist after crook touts 2M records
Government disputes claims of continued access as investigators measure damage
France's tax authority has admitted to a data heist in June, after an alleged cybercriminal advertised a database containing 2 million taxpayers' information. The intruder, going by the name ZeroBytes, claimed to have accessed the database using stolen credentials and a technique that bypassed multi-factor authentication (MFA). Initially, the tax authority did not confirm ZeroBytes' claims regarding continued access to their systems.
However, in a statement released on Thursday, they denied this assertion. According to DGFiP, an unauthorized access was detected at the end of June 2026, following a cyberattack that reportedly occurred in June 2026. This access, which had been disconnected as part of an audit, allowed the extraction and consultation of data concerning individuals and professionals.
Following this incident, DGFiP implemented additional security measures to prevent further unauthorized access. The investigation is ongoing to determine the exact data and number of users affected. The tax authority plans to report the breach to the French data protection watchdog CNIL and notify affected users once this information has been established.
This intrusion is part of a series of cybersecurity breaches affecting France's public sector this year. Other notable breaches include the theft of 1.2 million records containing French citizens' bank details by miscreants who used stolen credentials, and the unauthorized access of around 15.8 million administrative files by hackers targeting France's Health Ministry.
Additionally, a 15-year-old reportedly breached France Titres, the government agency responsible for identity documents, affecting between 18 million and 19 million people.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
