French tax authority says break-in exposed data of 600K, including some private messages
Stolen details range from contact information to household finances and withholding rates
France's tax authority, the General Directorate of Public Finances (DGFiP), has confirmed that an attack last week may have exposed sensitive data of around 600,000 people and businesses. In an update, the DGFiP revealed that lists of messages exchanged with the authority were compromised. Approximately 250 individuals had their actual messages stolen, while over 350,000 people had their tax identification numbers, marital status, email and postal addresses, phone numbers, and other tax-related information exposed.
The data breach also included details such as household composition, number of dependents, family quotient, reference tax income, and withholding rates. For businesses and professionals, the compromised data consisted only of company names and SIREN numbers. The tax authority is notifying affected individuals and businesses about the breach via email or mail.
DGFiP warns that scammers could exploit the stolen information for phishing attempts, impersonation, CEO fraud, and bogus bank adviser scams. The agency has stated it would never ask taxpayers for sensitive data like PINs or identity documents via phone, text message, or email. Additionally, the tax authority disclosed a technical vulnerability in the government's Vacant Successions Portal, which was temporarily suspended after its discovery.
This incident adds to a year marked by cybersecurity issues across France's public sector, including a finance ministry data breach affecting 1.2 million people in February, a Cegedim Santé data theft in March, a Tchap breach in June, and a potential breach of the government's encrypted messaging platform.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
