France’s tax agency hit by major breach exposing 678,000 taxpayers
A sophisticated cyberattack on France’s tax agency has compromised the personal data of 678,000 taxpayers, including income and tax details, prompting a criminal investigation and heightened concerns over government cybersecurity. The breach, described as more advanced than previous incidents, targeted both individuals and businesses, though officials stressed that access to secure tax accounts was not granted.
After the breach, a wave of scrutiny
The Directorate-General for Public Finances (DGFiP) confirmed the attack and launched an immediate investigation led by the cybercrime unit of the Paris Public Prosecutor’s Office, with support from OFAC, France’s dedicated cybercrime office. While the stolen data does not allow access to taxpayers’ secure accounts on impots.gouv.fr, it includes income figures, tax rates, and family circumstances—information that could be weaponized in phishing scams or fraudulent calls. Authorities have begun notifying affected individuals starting this week, emphasizing the risk of identity theft and further fraud attempts.
The breach follows a string of recent cyberattacks on other French public bodies, including systems linked to ANTS (the national secure documents agency) and INSEE (the statistics authority), suggesting a troubling pattern. Public Accounts Minister David Amiel has asked the DGFiP to propose strengthened security measures in response.
What’s next—and what taxpayers should do
Investigators are still piecing together how the attackers infiltrated the system, their identities, and whether the stolen data has already been exploited. For now, anyone contacted about this breach should treat unsolicited requests for passwords or banking details as suspicious, regardless of how official they appear.
Follow RFI’s report for ongoing updates
Why it matters
This breach underscores the growing sophistication of cyber threats targeting government systems, where even non-financial data can fuel large-scale fraud. For taxpayers, the incident highlights the need for heightened vigilance against identity theft and phishing. For authorities, it signals that current defenses may require urgent upgrades to prevent similar attacks in the future. The pattern of breaches across multiple agencies also raises questions about systemic vulnerabilities in France’s public digital infrastructure.
Source: Security Affairs. AI-assisted editorial synthesis — TechnoExpress.