French tax authority data breach hits 678,000 users, PM chairs crisis cell

The breach

France's tax administration (DGFiP) confirmed on Friday that a sophisticated intrusion into its information systems had extracted data belonging to 678,000 individuals and businesses. The Paris prosecutor's cyber section opened an investigation on Saturday, entrusting the case to the Office anticybercriminalité (Ofac). The probe covers "fraudulent extraction of data" from a state-run personal data processing system and "participation in a criminal association for the preparation of an offence punishable by at least five years' imprisonment." The DGFiP filed a formal complaint, and a notification was sent to the CNIL, France's data protection authority.

Amélie Verdier, director general of public finances, detailed the scope of the stolen data. For individuals, the breach exposed names, family quotient, reference tax income, and withholding tax rate. For businesses, the data was described as "less sensitive than individuals," including Siren numbers and business and mandatary addresses. The tax authority stressed that the stolen data "does not allow access to the secured account on impots.gouv.fr."

The hacker

A hacker operating under the alias ZeroBytes has claimed responsibility for the leak, according to franceinfo journalist Valentin Stoquer, who communicated with the perpetrator. The hacker said they acted as a pair, driven by financial gain, and offered the data for sale on a forum, with free samples containing information on dozens of people.

There is not necessarily a connection with politics. We found it and we exploited it.

When asked about potential legal consequences, the hacker responded that they were not in France and that there was no extradition from their location. ZeroBytes has claimed responsibility for several previous cyberattacks, including the Intermarché drive, a video game company, and the French Handball Federation. France Télévisions verified the data's authenticity by calling affected individuals, including a woman confirmed to be living in Germany as listed in the file, who had already been targeted by a fraud attempt.

Government response

Prime Minister Sébastien Lecornu will chair an interministerial crisis cell (CIC) on Monday afternoon via secure videoconference, following a visit to Gironde. Matignon announced the meeting on Sunday, stating it would ensure that individual notifications to the 678,000 affected users are "fully ready before launch." Users will be contacted starting Monday with details of the exposed data and recommended vigilance measures.

Lecornu has also requested an audit from Minister of Action and Public Accounts David Amiel on securing DGFiP IT systems, with operational measures to be presented in September. The crisis meeting will review the broader public administration cybersecurity plan launched on April 30, which includes 200 million euros in funding to bolster defenses against cyberattacks.

Political reactions

The breach has drawn sharp political reactions. Socialist senators sent a letter to Senate President Gérard Larcher requesting a parliamentary inquiry commission, noting a succession of incidents that does not yet allow them to conclude a structural failure but warrants checking for common vulnerabilities. Bruno Retailleau, presidential candidate for the conservative Les Républicains party, wrote on X that France is "the second most affected country in the world by cyberattacks" and called for a "Plan Vauban" to build a "true digital fortress" and protect the data of French citizens.