France Investigates Data Breach at Tax Authority After Hacker Claims 600,000 Victims
France's tax authority, DGFiP, confirmed a data breach in late June, with a hacker claiming to have accessed data belonging to 600,000 individuals and businesses.
France’s Directorate General of Public Finances (DGFiP) has confirmed a significant data breach impacting its information systems, leading to the extraction of sensitive data on individuals and businesses. The intrusion, which occurred in late June, was detected and contained by the agency, but not before an attacker gained unauthorized access. The incident came to light after a hacker, using the alias ZeroBytes, claimed responsibility and asserted access to data on over 600,000 people.
According to a statement from France’s Economy Ministry, the attacker gained access through the theft or misuse of an individual's identity. This allowed them to view and subsequently extract data. While the DGFiP has not confirmed the exact scope or authenticity of the hacker's claims, they are actively investigating to determine precisely what information was compromised and the number of affected parties. The ministry stated that individuals whose data was impacted will be contacted directly with information on the exposed data and necessary precautions.
The hacker, ZeroBytes, reportedly claimed to have accessed internal servers, enabling them to connect to the agency’s VPN and utilize an internal tool to search for and exfiltrate personal information. The purported data includes names, tax identification numbers, email addresses, family circumstances, and tax status details. The DGFiP has initiated a criminal complaint and will notify France's data protection authority as its investigation progresses.
This breach marks the latest in a series of cyber incidents affecting French government agencies this year. In April, the National Agency for Secure Documents (ANTS), responsible for passports and driver's licenses, was targeted. The Education Ministry also disclosed a breach exposing student personal information in the same month. Furthermore, in February, a part of the National Bank Accounts File was compromised, affecting approximately 1.2 million accounts.
Authorities have been actively pursuing cybercriminals targeting public institutions. Earlier this year, a 20-year-old man was arrested on suspicion of conducting numerous data breaches against government bodies, sports federations, and private companies. The DGFiP has not yet attributed the current breach to a specific threat actor or confirmed the hacker's specific claims about the method of access or the extent of data exfiltration.
The incident underscores the persistent threat posed by identity-based attacks and the vulnerabilities within government IT infrastructure. The DGFiP's confirmation and ongoing investigation highlight the critical need for robust identity management and continuous monitoring to detect and prevent such intrusions, especially when sensitive personal and financial data is at stake.
France's tax authority (DGFiP) has confirmed that a data breach occurred in late June, with an attacker advertising over 2 million taxpayer records. The agency stated that the intrusion was severed in June and is currently investigating the full scope of affected data and users, disputing claims that the attacker still has access. This incident follows a pattern of recent breaches affecting French public sector entities, including the Ministry of Finance and France Titres.