France Confirms Major Cyberattack on Tax Authority, Data of Thousands Leaked

French tax authorities confirmed that the information system of the Directorate General of Public Finances suffered an unauthorized intrusion in late June, exposing sensitive data belonging to hundreds of thousands of taxpayers, according to an announcement issued by the French Ministry of Economy and Finance.

The security breach, which took place through a case of identity usurpation, compromised records for both private individuals and professionals. While state officials initially withheld specific metrics regarding the scope of the leak, independent cybersecurity monitoring organizations and specialized platforms tracked thousands of affected files circulating online, triggering a formal response across several government cybersecurity agencies.

As financial investigators and data protection authorities examine the full extent of the exposure, the incident highlights ongoing vulnerabilities in critical public administration infrastructure. The breach follows prior high-profile cyber intrusions targeting French state digital portals, prompting renewed government commitments to overhaul national cybersecurity frameworks.

Investigation and Institutional Response

According to official statements from Bercy, the security breach occurred at the end of June following a fraudulent identity takeover that allowed an unauthorized actor to bypass perimeter controls. Although the intrusion vector was identified and the illicit access was subsequently severed during control operations conducted in late June, subsequent investigations confirmed that data had already been consulted and extracted from the system, as reported by Les Echos.

In response to the incident, the Directorate General of Public Finances initiated formal legal complaints and notified the Commission nationale de l’informatique et des libertés (CNIL), France’s independent data privacy watchdog. Technical investigations are being conducted in close coordination with specialized state security bodies, including the service of the High Functionary for Defense and Security and the French National Cybersecurity Agency (ANSSI).

Government officials have stated that all individuals and corporate entities identified as potentially impacted will receive direct, individual notifications. These communications are designed to detail precisely which categories of data were accessed or extracted, alongside recommended security measures and vigilance protocols that affected users should adopt.

Scope of the Compromised Data and Claims

Reports from monitoring groups suggest that an online actor operating under the alias ZeroBytes claimed responsibility for the intrusion, subsequently offering the compiled database for sale. Beyond standard contact details such as names, postal addresses, email addresses, and telephone numbers, the exposed records reportedly include sensitive fiscal information. These protected elements encompass household tax composition, tax share allocations, specific tax rates, and reference fiscal income figures—data that carries significant value for malicious networks seeking to target affluent households.

Wider Context and National Cybersecurity Overhaul

This incident arrives in the wake of other major digital security breaches within French public administration portals. Earlier in the year, the National Agency for Secure Titles experienced a significant cyber intrusion that compromised millions of accounts, prompting Prime Minister Sébastien Lecornu to unveil an aggressive action plan aimed at reinforcing national cyber defenses.

The government strategy includes the establishment of a centralized state digital authority reporting directly to Matignon, backed by substantial financial investments. An allocated envelope of 200 million euros has been designated to modernize application architecture, upgrade automated threat detection systems, and implement post-quantum cryptography measures to safeguard vital state databases against increasingly sophisticated cyber threats.

Taxpayers seeking further guidance on cybersecurity vigilance or expecting updates regarding the investigation are advised to monitor official channels published by the French public administration and the CNIL.