France creates emergency cyber unit after hackers leak 678,000 tax records
Prime Minister Sébastien Lecornu ordered the national cybersecurity agency to establish a rapid-response unit following repeated data breaches across French public ministries.
Breach at the tax agency
Hackers penetrated the information system of France's Public Finance Directorate General (DGFiP) on 26 June 2026, gaining access through a virtual private network used by tax officials. The intruder remained inside the network undetected for weeks before listing the personal information of 678,000 taxpayers for sale on a dark-web forum on 12 August. French authorities publicly acknowledged the breach on 14 August after confirming the theft of names, reference income data, and tax rates. The agency suffered a second attack in July that compromised data from 200,000 land registry accounts. On 18 August, DGFiP head Amélie Verdier confirmed that investigators had detected an additional data breach that remains under evaluation.
The hackers and expanding targets
A hacking duo operating under the name ZeroBytes claimed responsibility for the DGFiP intrusions, telling Agence France-Presse that their primary motive was financial gain. The group stated that they had already sold the stolen fiscal records to two buyers for thousands of euros. ZeroBytes also claimed to possess land registry records covering approximately two million property owners, alongside archived files from the Ministry of National Education detailing millions of students and tens of thousands of teachers across a 20-year span. Public services across France have faced recurring intrusions since the summer of 2025, including breaches at social security collection agency Urssaf, identity agency ANTS, and the Ministry of National Education.
- Finance ministry reports breach compromising details of 1.2 million bank accounts.
- Identity document agency ANTS suffers breach affecting nearly 12 million people.
- Intruders access DGFiP tax systems using an official VPN connection.
- Hackers post stolen financial data of 678,000 taxpayers for sale on the dark web.
- French authorities publicly acknowledge the tax administration data theft.
- Sébastien Lecornu orders ANSSI to create a rapid-response cyber unit.
Government creates emergency cyber unit
In response to the intrusions, Prime Minister Sébastien Lecornu instructed the National Cybersecurity Agency (ANSSI) on 19 August to establish a new specialized cyber unit. Lecornu sent a formal letter to the General Secretariat for Defence and National Security (SGDSN), requesting an organizational structure and operational rules of engagement by 21 August. The prime minister also ordered ANSSI to conduct a thorough audit of the security posture at the tax directorate. Lecornu stated that very few state ministries currently meet necessary cybersecurity requirements across their networks.
There is an urgent need to design and lead without delay a more reactive and stronger operational response to the cyberattacks the state is currently facing. We must regain the initiative on the ground.
Defensive upgrades and sovereign software
The French government plans to allocate 200 million euros toward combating cybercrime as part of a budget expansion running through 2030, building on ANSSI's 2025 baseline budget of 44.2 million euros. Budget Minister David Amiel announced on 18 August that the finance ministry will deploy artificial intelligence tools to stress-test digital defenses across administrative departments. Amiel specified that the ministry will restrict these vulnerability tests to sovereign European AI software such as France's Mistral, deliberately excluding American providers like OpenAI. Cybersecurity strategist Nicolas Arpagian noted that France's centralized technological model creates single points of failure when remote workers and subcontractors connect into core state databases.
This is not acceptable. Cybersecurity is not just a matter of funding, it is also a discipline.
