France confirms cyberattack on tax system exposed data of 678,437 people

Breach and discovery

France's Ministry of Economy and Finance announced on Thursday 13 August that the information system of the Directorate General of Public Finances (DGFiP) was the target of an "illegitimate access" at the end of June 2026, following an identity theft. The intrusion targeted Impots.gouv.fr, the official portal of the DGFiP intended for both individuals and professionals. The access was cut off at the end of June as part of controls carried out by the DGFiP, but the attacker had already been able to consult and extract data concerning both individuals and professionals. On Wednesday 12 August, a malicious actor publicly claimed responsibility for the intrusion, prompting Bercy to confirm the breach the following day, nearly two months after the facts. The ministry did not specify the nature of the data or the number of taxpayers concerned in its communiqué.

Bercy stated that the first investigations confirmed the access had allowed data consultation and extraction despite being cut off.

The first investigations confirm that this access, which had been cut off at the end of June as part of the controls carried out, nevertheless allowed the consultation and extraction of data concerning individuals and professionals.

Scale of the first leak

While Bercy has not provided figures, the specialized website French Breaches, which documents cyberattacks committed in France, reported on Thursday morning that 678,437 people are concerned, including 392,867 individuals and 285,570 professionals. French Breaches stated on X that the file is now for sale for several thousand euros. Le Parisien noted that the stolen data is far more confidential than a simple address or social security number, without specifying the exact nature of the fiscal data involved. The discrepancy between the figure cited by Le Parisien (678,438) and French Breaches (678,437) was not explained.

A second, larger leak claimed

On Thursday evening, a French Breaches representative told AFP that a new leak linked to the DGFiP had been claimed, this time concerning nearly two million owners of real estate and land properties in France. According to French Breaches, the hacker claims to hold names, dates of birth, addresses, property identifiers, cadastral parcels, and information about the properties held. The hacker also claims to still have access to the DGFiP account. Bercy did not address this second claim in its communiqué. The French Breaches website was momentarily down on Thursday evening.

Government response and next steps

Bercy stated that after the attack was claimed on Wednesday, the DGFiP immediately implemented new restriction measures to end the breach and prevent further illegitimate access. Investigations are ongoing to determine precisely which data was compromised and how many users are affected. The DGFiP's IT teams are working with the Senior Defence and Security Official. Affected users will receive individual notifications specifying the data that may have been consulted or extracted and, where applicable, the vigilance measures to adopt. As is standard procedure in this type of incident, the DGFiP will notify the National Commission for Informatics and Liberties (CNIL), file a criminal complaint, and communicate new elements as the investigations progress.